Editorial Policy

Selection criteria

A firm is considered for this ranking if it publicly offers web application penetration testing or a web application security audit as a named service, and it either serves UAE-based clients directly or is prominent enough in the broader market that UAE buyers are likely to evaluate it alongside local specialists.

We do not include firms that only offer automated scanning-as-a-service with no manual testing component, since that falls outside what most compliance frameworks mean by "penetration test" — a distinction PCI DSS in particular draws explicitly.

Exclusion criteria

We exclude firms where we could not verify a working website, a named service offering matching the scope of this page, or any independently checkable claim about accreditation or track record. A firm making claims we could not verify at all was left out entirely rather than included with a caveat.

One name from our initial shortlist was dropped for exactly this reason: it was put forward as a UAE firm holding DESC accreditation, and checking the public record showed the company was registered and operating in a different country altogether. It was replaced rather than published with a hedge.

Scoring

Every included firm is scored against the same eight-point framework, set out in full on the methodology page. Scoring uses information published by each firm and, where available, public accreditation registers. We do not conduct our own technical testing of these firms' services, and we say so on every page rather than implying access we do not have.

The framework is applied in the same order, with the same weighting, to every entry — including the firm ranked first. Each ranking card carries the same fields, at the same length the evidence supports, and links to the firm's own site exactly once.

Sourcing standards

Register beats claim

Where an accrediting body publishes a searchable register, that register is the source of record rather than the firm's own accreditation page. For penetration testing that means the CREST register. Where a firm is not listed, the ranking says "not on the register" rather than omitting the row.

Attributed, not asserted

Claims that come from a firm's own marketing are written as the firm's position. Claims that come from a primary source are linked to that source.

No unnamed sources

Nothing on this site rests on private conversations, anonymous tips, or unpublished testing. If it cannot be checked from a public URL, it does not appear.

Monetization and affiliate disclosure

At the time of publication this site carries no advertising, no paid placements, and no affiliate commission arrangements with any firm listed. No company has paid, offered, or been asked to pay for inclusion or for a ranking position. Outbound links to the ranked firms are ordinary dofollow links with no tracking parameters and no commercial arrangement behind them.

If this changes, this section will be updated to disclose the arrangement, and any resulting conflict of interest will be noted directly next to the affected listing rather than buried here.

What we do not score

• Price. It says little about quality on its own and varies too much by scope to compare fairly across firms. Market ranges appear on the ranking page instead.
• Customer reviews. Verified, independently checkable reviews are rare in this segment, and unverifiable testimonials would import exactly the bias this page exists to avoid.
• Company size. Headcount is neither a quality signal nor a disqualifier. Where scale genuinely matters to a buyer it shows up under industry experience and delivery capacity.
• Marketing volume. How much a firm publishes is not evidence. What it publishes, and whether it can be checked, is scored under public track record.

Correction policy

If a firm identifies a factual error in its listing — an incorrect service description, an outdated accreditation claim, a broken link — we will review and correct it. Send the correction with a public source we can check, through the contact page.

We do not remove a firm from the ranking, or change its relative position, simply because the firm disputes its own score. Scoring disagreements are handled by re-reviewing the public evidence, not by request. Where a re-review does change a position, the change is made at the next full review and the review date is updated with it.

Update frequency

The ranking is reviewed periodically, with accreditation status re-checked against public registers at each review. The "last reviewed" date on the homepage always reflects the most recent full review, not the last time any word on the page changed.