Each provider gets one evidence level per criterion, in words. The order of the list is a reasoned judgment of how persuasive the public evidence is overall. It is not a sum of the levels.
This directory helps a UAE buyer decide which purple team providers to talk to. It reports what each provider publishes, shows where it published nothing, and says how a position was reached. It does not test providers and it does not rate the quality of their delivery.
Related reading: how to choose a purple team provider and measuring purple team results.
Phases, steps and rules of engagement a buyer can read before contact.
What counts as evidence. A first-party page or datasheet that lists the steps of the purple team engagement in order.
What does not. A tagline, a list of benefits, or a third-party description of how the provider works.
Offensive, defensive and adjacent services that make a purple engagement workable.
What counts as evidence. Published service pages for red team or penetration testing, detection and response, and related advisory.
What does not. Reseller or partner logos, or services listed only in a press quote.
Local delivery details and stated alignment with UAE regimes.
What counts as evidence. A published UAE delivery statement, and UAE regimes the provider names on its own pages.
What does not. A UAE-dated press release alone, or a regulation list that only a third-party directory attributes to the provider.
What the final report contains.
What counts as evidence. An itemised list of report contents, such as a stage-by-stage account, findings, detection recommendations and an improvement plan.
What does not. A promise of "actionable insights" or an outcome statement with no report contents.
Intelligence-led scenarios and technique mapping.
What counts as evidence. A statement on the provider's own pages that scenarios are mapped to MITRE ATT&CK or built from the provider's threat intelligence.
What does not. A general mention of "threat intelligence" in the company profile.
Accreditations and certifications the buyer can check with the issuer.
What counts as evidence. A named accreditation or certification that the buyer can look up with the issuing body.
What does not. The words "certified experts" with nothing named, a count of certificates with none listed, or analyst-ranking claims.
Joint execution with defenders, detection tuning, retest.
What counts as evidence. A published description of live joint execution with the defenders and of detection tuning. A published retest is noted in the narrative when present; its absence is stated and does not by itself lower the level.
What does not. A claim that red and blue skills exist in the same company, with no description of how they work together.
Four levels, each with its own hexagon shape and a text label, so colour is never the only signal.
| Level | Glyph | Meaning | Example |
|---|---|---|---|
| [ DOCUMENTED ] | filled hexagon | Specific, first-party and checkable. A buyer can read the detail on the provider's own page or in a primary document. | A page that lists the steps of a live exercise with the client's SOC and what the client receives. |
| [ PARTIAL ] | half-filled hexagon | Some specifics are published, and gaps remain that a buyer would have to close by asking. | A service page that names the phases but gives no duration or framework mapping. |
| [ STATED ONLY ] | outlined hexagon with a dot | A claim with no supporting detail. It may be true; this site could not check it. | A statement that staff hold certifications, with none named. |
| [ NOT PUBLISHED ] | empty dashed hexagon | No public statement found. This is not a finding that the provider lacks the capability. | No itemised report contents are published. |
Not published means no public statement was found. It is not a finding that the provider lacks the capability.
Whether a purple team provider fits depends heavily on the buyer's conditions and goals. A scoring system precise enough to produce one number would imply more precision than the available public evidence supports. So this site publishes no ratings, points, percentages or weights.
Ordinal positions, 1 to 8, are used because a ranked list needs an order.
The order is a reasoned judgment of the overall persuasiveness of each provider's public evidence across the seven criteria. It is not a sum of the levels, and the levels alone would not produce this order. Other providers are ahead of the first position on some criteria, and the evidence matrix on each profile shows where.
Each profile carries a Why this position paragraph in plain words, so you can follow the reasoning and disagree with it. A buyer with different conditions may reasonably order the list differently.
The eight profiles, in order:
If you represent a listed provider and a fact is wrong or out of date, send the corrected fact with a public source through the contact form. We update the profile and the changelog below. A provider can also ask for its reply to be linked from its profile.
Providers can submit a company. We check it against the same seven criteria. Submitting does not guarantee inclusion or position.