What do I check first?

Five checks, in this order.

  1. A confirmed purple team service. Not a red team page and a SOC page side by side. The methodology page calls this live collaboration and retest.
  2. A published method and length. Group-IB states one to eight weeks, and the Mandiant datasheet states about three. Most providers state neither.
  3. Named report contents. The Mandiant datasheet itemises its report. Paranoid Security’s cyber exercises page itemises three outputs. Many providers list none.
  4. UAE delivery. An office, where staff sit, and the regime you are assessed against.
  5. Credentials you can verify. See below.

What do I ask in an RFP?

  • Who runs the attacker side, and who coordinates with our SOC during the exercise?
  • How are scenarios chosen, and which ATT&CK techniques will be covered?
  • What does the report contain? Is a retest included?
  • Which entity contracts the work, and where will delivery staff and our data be?
  • Which clause of our regime does the report map to?
  • What do you need from us: log sources, analysts, access?

How do I verify UAE references?

Ask for a named reference in your sector and call it. A press release dated in Dubai shows an announcement, not delivery. Check the UAE fit section of each profile in the ranking.

What are the red flags?

  • No description of how defenders take part.
  • Certifications claimed with no issuer named.
  • A fixed price quoted before scoping. Cost drivers are in the cost and scoping guide.
  • A claim that a UAE regime requires purple teaming, with no clause cited. See UAE regulations and purple teaming.
  • Reviews or ratings offered in place of evidence.

Should the provider be locally registered?

Ask rather than assume. A provider headquartered in the UAE, such as CPX, differs from a global provider with a regional subsidiary. Neither is wrong for every buyer. What matters is what your contract and regime need.

What do the evidence levels tell me?

They tell you what a provider published, not how well it delivers. Use them to shortlist, then test the answers in a call. A provider with little published, such as Zensec, which names five stages but no length, framework or report contents, may still be worth asking, and the profile lists what to verify.