Two Services, Often Confused

A UAE client asks for a "security test." Some want a penetration test. Some want a vulnerability assessment. Most can't tell the difference — and neither can their vendors, half the time.

The difference matters. One produces a scan report; the other produces evidence of real-world exploitability. One costs AED 5,000; the other AED 20,000 – 60,000. One satisfies a PCI DSS quarterly scan; the other satisfies an ISO 27001 or enterprise procurement demand.

Here's the plain-English breakdown.

What a Vulnerability Assessment Actually Is

A Vulnerability Assessment (VA) is a breadth-first, scan-based inventory of known vulnerabilities. Tools like Nessus, OpenVAS, Nuclei, and Qualys run automated checks against your targets and produce a list of findings with CVSS scores.

  • Goal: Catalogue known vulnerabilities.
  • Method: Automated scanning, with manual validation of criticals.
  • Depth: Shallow — checks for known patterns, doesn't attempt exploitation.
  • Output: Findings report with CVSS scores and remediation guidance.
  • Typical cost (UAE): AED 5,000 – 15,000 per engagement.
  • Typical duration: 2 – 5 working days end-to-end.

VA is the right choice when:

  • You're an SME doing your first formal security assessment
  • You need PCI DSS quarterly external scan evidence
  • You need a cheap, recurring baseline of known-issue exposure
  • Your budget can't stretch to a full pen test

What a Penetration Test Actually Is

A Penetration Test is a depth-first, manual attack simulation by a credentialed offensive-security practitioner. The tester starts where scanners stop: chaining findings together, escalating privileges, moving laterally, and demonstrating the actual business impact of weaknesses.

  • Goal: Find real-world paths an attacker could exploit.
  • Method: Manual, exploit-driven, context-aware testing.
  • Depth: Deep — scanners are tools; the testing is human.
  • Output: Findings report with reproduction steps, business impact, and remediation walkthrough.
  • Typical cost (UAE): AED 15,000 – 60,000 depending on scope.
  • Typical duration: 2 – 3 weeks including scoping, testing, reporting, walkthrough.

Pen testing is the right choice when:

  • An enterprise client or bank has asked for a pen-test report
  • You're preparing for ISO 27001, SOC 2, PCI DSS, or NESA audit
  • You've recently deployed significant infrastructure or application changes
  • The board or CISO has asked what an attacker would actually find

The Critical Difference

A scanner finds: "Apache 2.4.41 is installed; CVE-2021-42013 exists."

A pen tester finds: "Apache 2.4.41 is installed; the CVE is exploitable in your configuration; I used it to gain shell access; I pivoted to your internal network; I captured credentials from the domain controller; here's the forest root I achieved in 4 hours."

Both findings might score the same CVSS. Only one is useful to an auditor asking for evidence of exploitability.

Which Satisfies Your Compliance Requirement?

  • PCI DSS quarterly external scan: VA only. ASV-authorised scanner sufficient.
  • PCI DSS annual penetration test: Pen test required. Specifically called out in the standard.
  • ISO 27001 Annex A.8.8: Pen test preferred; VA alone usually insufficient for certification auditor.
  • NESA / UAE IA V2 technical controls: Pen test preferred; VA as evidence of continuous scanning.
  • PDPL: Neither explicitly required, but pen test highly recommended for data-handling systems.
  • SOC 2: Pen test effectively mandatory for the trust services criteria.
  • Enterprise procurement pen-test demand: Pen test, always. VA alone doesn't pass procurement review.

The Bundling Question

Many UAE mid-market organisations end up needing both over time:

  • Annual pen test (mandatory for compliance, deep assurance)
  • Quarterly VA (continuous monitoring, cheap coverage, satisfies ongoing-scan requirements)

Most of our pen-test clients add a recurring VA retainer after the first engagement — AED 5,000 – 12,000 per quarter for standing coverage.

The "Which Do I Actually Need" Decision Tree

  • Starting from zero, no specific compliance driver? VA first. Get the baseline, fix the obvious. Upgrade to pen test when the scope or client demand justifies it.
  • Compliance driver (ISO 27001, SOC 2, PCI DSS, enterprise client contract)? Pen test. Non-negotiable.
  • Recurring cheap coverage needed? VA on retainer, plus annual pen test.
  • Had an incident? Pen test. You need to know what the attacker could have done beyond what they did.

What We Recommend Day-1

For UAE SMEs (10 – 50 employees) with no formal security posture, we typically recommend:

  1. Vulnerability Assessment to set the baseline (1 week, AED 5,000 – 10,000)
  2. Fix the top 10 critical/high findings (2 – 4 weeks, your IT team)
  3. Web Application Penetration Testing if customer-facing web surface (3 weeks, AED 15,000 – 25,000)
  4. Or Network Penetration Testing if the exposure is more infrastructure than app (3 weeks, AED 20,000 – 40,000)

Total first-year offensive-security spend: AED 25,000 – 50,000 for a serious, defensible program.

Not sure which one you need? 30-minute scoping call, we'll tell you honestly.