Location · Dubai, UAE
Independent application security reviews for UAE organisations
From Colombo, 90 minutes ahead, I assess your apps, APIs and edge controls remotely, and join you in the UAE for the workshops that need a room.
- Dubai
- UTC+4
- GCC
In short
For organisations in the UAE, I run application security assessments remote-first from Colombo, which is 90 minutes ahead, with on-site visits for workshops and key phases. I assess web and mobile apps, APIs (application programming interfaces), edge protection and monitoring, and map findings to the rules you work under, from federal data protection law to sector requirements. You get a vendor-neutral, prioritised plan.
How we work together
Remote-first, on-site where it counts.
every working day
The market
What I see in UAE.
- App-first customersCustomers expect banking, payments and government services in an app, so new channels launch quickly.
- Federal and free-zone rulesFederal data law sits beside free-zone regimes such as DIFC and ADGM, so scope depends on where you are licensed.
- Partner APIs multiplyOpen finance, aggregators and super-apps keep adding integrations, and each one is a new door to watch.
Rules you work under
The frameworks I map findings to in UAE.
Findings are written so your risk, audit and compliance teams can use them directly. This is orientation, not legal advice.
- UAE Federal GovernmentFederal Decree-Law No. 45 of 2021 on the Protection of Personal DataThe federal baseline for personal data in apps and APIs. The DIFC and ADGM free zones run their own regimes.
- TDRA, United Arab EmiratesUAE Information Assurance RegulationSets information assurance controls for government entities and critical sectors, including how systems are developed.
- PCI Security Standards CouncilPayment Card Industry Data Security Standard (PCI DSS) v4.0.1Card-accepting apps and checkouts must meet it, whether you are licensed onshore or in a free zone.
Sectors
Who I work with in UAE.
- BankingMobile apps, APIs and internet banking that regulators watch closely.Explore
- Fintech & paymentsWallets, payment APIs and apps that ship weekly and must stay trusted.Explore
- InsuranceCustomer and broker portals and partner APIs full of sensitive data.Explore
- Manufacturing & groupsLarge estates of sites, portals and APIs spread across business units.Explore
- GovernmentCitizen services that must stay secure, available and trusted.Explore
Services
Assessments available in UAE.
Fixed scope and a fixed fee. Every engagement ends in a prioritised plan you can take to any delivery partner.
- AppSec maturity assessmentScored baseline, gap analysis, 12–24 month roadmap, board summary
- Application architecture reviewThreat model, control coverage map, prioritised fixes
- WAAP & API protection assessmentCoverage gaps, bypass paths, migration or tuning plan
- Mobile app security assessmentMobile threat model, protection policy, MASVS test plan
- Exposure management (CTEM) assessmentPrioritisation model, validation approach, owner playbook, metrics
- Executive briefing or team workshopPlain-language risk briefing or hands-on workshop
- Fractional AppSec advisorRoadmap governance, vendor and design reviews, escalation support
Can you assess our applications remotely from Sri Lanka?
Yes. Configuration reviews, evidence checks and most testing work well remotely, and Colombo is only 90 minutes ahead of the UAE, so working hours overlap almost entirely. I plan on-site visits for the kick-off, stakeholder workshops or the findings presentation where being in the room helps. Visits and their timing are agreed in the scope before any work starts.
What does the assessment give a UAE board?
A short summary in business terms: the top application risks, where you stand in each of six areas, and a 30, 90 and 365-day plan with effort and cost ranges. Behind it sits the evidence your technical teams and auditors need. Execution is never assumed. It is scoped case by case with your team, a partner of your choice or Innov8, always disclosed.
Does UAE data protection law affect application security?
Yes. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data expects organisations to protect personal data with appropriate technical and organisational measures, and most of that data moves through apps and APIs (application programming interfaces). Entities in the DIFC (Dubai International Financial Centre) and ADGM (Abu Dhabi Global Market) follow their own data protection rules. I assess the application controls; legal advice stays with your counsel.
Which UAE organisations is this service designed for?
Banks, payment and fintech companies, insurers, large family and holding groups, and government entities with customer-facing apps and APIs (application programming interfaces). The common thread is a sizeable application estate where an independent view helps: before a platform change, after an incident, ahead of an audit, or when the board asks where application risk really stands.
Other locations