Wattlecorp

Cyber security services company with a UAE purple team assessment page and UAE compliance audit services.

Position 5 of 8Last verified: 4 Nov 2026

Visit provider site (opens in a new tab) All rankings

Facts

Facts as published
Headquarters / legal entity Listed locations are USA, UAE, India, Saudi Arabia, UK and Singapore, with no headquarters designated Documented Source
Services in the region UAE listed as a location, with a Dubai phone contact. Offers services in the region. Documented Source
Purple team service Published, as a UAE purple team assessment service Documented Source
Engagement length, as published Not published. Cost depends on scope, infrastructure size, environments and testing duration. Documented Source
Delivery model, as published Not published
Credentials, as published
  • An image on the page carries the alt text ISO 27001 certified. No certificate, issuer or number is given. Vendor-reported Source
  • A third party reports that the company was not found on CREST's marketplace. Not confirmed either way. Not confirmed Source

Tags: Documented stated specifically on a first-party or primary page. Vendor-reported a claim by the provider that cannot be checked independently. Not confirmed not verified from a primary source.

Purple team service

[ PUBLISHED ]

Wattlecorp publishes a purple team assessment page for the UAE.

What it is, as published. The red and blue teams work together on scenario-based tests that are built from a review of the client’s capabilities, technologies and controls.

Phases, as published.

  1. Reconnaissance: examine capabilities, technologies and controls.
  2. Monitoring: purple team experts simulate attacks while the blue team tries to repel them.
  3. Reporting and remediation: analyse what the red team could attack and list recommended fixes.
  4. Retest: repeat the test once the fixes are in place.

FAQ content, as published. Preparation means identifying critical assets, defining objectives, coordinating internal teams and granting controlled access. Cost depends on scope, infrastructure size, environments and testing duration, with a custom quote. Participants typically include security leadership, SOC teams, incident response teams, IT administrators and business stakeholders.

What is absent. Duration, tools, ATT&CK reference, itemised report contents and price figures.

Evidence by criterion

Seven criteria, each rated in words. What the levels mean. A level describes what is published, not a finding that a capability is missing.

1. Published methodology [ PARTIAL ]

Four phases are published, from reconnaissance to a retest, but no duration, tools or framework is stated. Source

2. Service breadth [ DOCUMENTED ]

The services page lists application, network, cloud, industrial and managed security services, threat simulation and compliance consulting. Source

3. UAE regional and regulatory fit [ PARTIAL ]

The services page lists UAE-relevant audits, including ADHICS, UAE Information Assurance Regulation and PCI DSS. The purple team page mentions GDPR, PCI DSS and other UAE regulations in general terms. Source

4. Deliverable specificity [ PARTIAL ]

The page describes post-exercise analysis, remedial recommendations and a retest. It does not itemise report contents. Source

5. Threat-intelligence and ATT&CK alignment [ NOT PUBLISHED ]

The page does not mention ATT&CK or threat intelligence. Source

6. Verifiable credentials [ STATED ONLY ]

An image alt text claims ISO 27001 certification. No certificate or issuer is given. Source

7. Live collaboration and retest [ DOCUMENTED ]

The page describes red and blue teams working together on scenario-based tests, an analysis of what the red team could attack, remedial recommendations, and a retest after fixes. Source

Why this position

Wattlecorp sits fifth because it publishes four phases that end in a retest, a clear statement of what drives cost and who takes part, and a UAE-facing services page with UAE audit services. It sits below the providers above because it states no duration, no tools and no framework mapping, and the one credential on the page is an image caption. A buyer who values a published retest and UAE audit services could weigh it more heavily than this order does.

The order is a reasoned judgment, not a sum of the levels. See how the order is decided.

Deliverables as published

No itemised report contents published.

No itemised report contents published. The page mentions an analysis of what the red team could attack and a list of recommended fixes.

UAE fit

The UAE is listed as a location with a Dubai phone contact. The services page lists ADHICS, UAE Information Assurance Regulation and PCI DSS audit services.

Regimes the provider names

  • GDPR and PCI DSS, named on the purple team page (vendor-reported)
  • ADHICS, UAE Information Assurance Regulation audit and PCI DSS, named on the services page (vendor-reported)

Limits of public evidence

  • No duration, tools, ATT&CK reference or itemised report contents.
  • ISO 27001 appears only as image alt text. A third party reports the company was not found on CREST's marketplace; this was not confirmed.
  • The page carries a claim of being officially recommended by hackers. It is not repeated here.

Best suited for / less suited for

Best suited for

  • Buyers who want a retest after fixes built into the engagement
  • Buyers who also need UAE compliance audits scoped by the same provider

Less suited for

  • Buyers who need a published duration, tools list or ATT&CK mapping
  • Buyers who need a credential they can check with an issuer

Compare and read on

Compare with

Related guides

Are you this provider? Request a correction. See also all rankings.