AI security testing in United Arab Emirates
- Data regime
- Federal UAE data protection law, with free zones such as DIFC and ADGM operating their own regimes. Which applies depends on where the entity is registered.
- Working hours
- GST, three hours ahead of CET. A full morning of overlap, with the UAE working week running Monday to Friday.
- Languages
- Arabic and English, frequently in the same system.
- Delivery
- Remote testing against your staging or production endpoint, with scoping and findings sessions scheduled in the United Arab Emirates working day.
- Frameworks
- OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF, EU AI Act Article 15.
- Tools
- Garak, PyRIT, promptfoo, Giskard, Burp Suite and custom Python harnesses.
Authorised testing only
Every assessment runs under a written scope and authorisation from the owner of the system, agreed before any test is run.
Why AI security matters in United Arab Emirates
Three data protection regimes
Mainland companies fall under the federal Personal Data Protection Law, DIFC entities under the DIFC Data Protection Law, and ADGM entities under the ADGM regulations. Which one applies shapes what counts as a reportable AI leak.
DIFC rules on autonomous systems
DIFC added specific requirements for personal data processed through autonomous and semi-autonomous systems, including AI. Testing that the system behaves as documented is part of showing compliance.
Arabic and English together
Bilingual assistants need both languages attacked. Arabic prompts, transliterated Arabic in Latin script and code-switching between the two are tested alongside English.
Government-grade expectations
The UAE Cybersecurity Council and emirate-level security bodies set a high bar for systems that touch government or critical sectors, and AI is increasingly written into those expectations.
What gets tested
The six attack classes behind most serious findings. The full list, and the tooling used for each, is on the main AI security page.
Direct prompt injection and jailbreaks
Role-play, instruction override, payload splitting, encoding tricks (Base64, leetspeak, invisible Unicode) and multi-turn escalation, to see whether the model can be argued out of its instructions and guardrails.
Indirect prompt injection
Instructions planted in the content your system reads rather than in the chat box: an uploaded PDF, an inbound email, a web page an agent browses, a product review, a CRM note. This is the attack most production systems are least prepared for.
System prompt and configuration leakage
Extracting the hidden instructions, internal URLs, API structure, business rules and occasionally the credentials that developers put in a system prompt on the assumption nobody would see it.
Data exfiltration through output
Markdown images, auto-unfurled links and tool calls that quietly send conversation data or retrieved documents to an attacker-controlled server once a malicious instruction lands.
Excessive agency and tool abuse
Agents persuaded to send emails, issue refunds, change records or call internal APIs outside their intended purpose. Tested against the real tool permissions, including MCP servers and poisoned tool descriptions.
RAG and vector store weaknesses
Cross-tenant document leakage, retrieval that ignores the user's access rights, poisoned documents that steer answers, and embeddings that reveal more than the source permissions allow.
How the assessment runs
1. Scope and threat model
Map what the AI system can read, what it can do, who talks to it and what would hurt most if it went wrong. Written authorisation and rules of engagement are agreed before any testing.
2. Automated scanning
Garak, PyRIT and promptfoo run thousands of known attack patterns against the live or staging endpoint to establish a baseline quickly and cheaply.
3. Manual adversarial testing
The part that finds the serious issues: multi-turn manipulation, indirect injection through your real document and email flows, and chained attacks that scanners cannot plan.
4. Agent and integration testing
Every tool, API and permission the model can reach is tested for abuse, including privilege boundaries between users and tenants.
5. Report and fixes
Each finding comes with a reproduction, a severity, the OWASP LLM and MITRE ATLAS mapping, and a concrete fix — architecture first, filters second.
6. Retest and regression suite
Fixes are retested, and the successful attacks become a promptfoo suite in your pipeline so they cannot quietly come back with the next model upgrade.
Areas served
AI security testing is available across United Arab Emirates, including Dubai, Abu Dhabi, Sharjah, Ajman, Ras Al Khaimah, Fujairah, Umm Al Quwain, DIFC, Dubai Internet City, Business Bay, Jumeirah Lake Towers, Dubai Silicon Oasis, Jebel Ali Free Zone, ADGM, Al Reem Island, Masdar City, Yas Island. There is no local office — testing is delivered online, which is how AI endpoints are attacked in practice anyway.
AI risk in United Arab Emirates's key sectors
Where AI is being deployed fastest here, and the risk tested first in each sector.
Assistants over accounts, claims and policies are tested for data leakage, manipulation into actions and unsafe advice, with results documented for DORA, the AI Act and your regulator.
Property assistants hold lead data, owner details and pricing rules. Prompt injection that exposes other clients or commits to prices is tested before the bot goes public.
Booking and concierge bots are public and connected to reservations. They are tested for price manipulation, leakage of other guests' details and unauthorised booking changes.
AI support agents can be talked into refunds, discount codes and policy exceptions, and product-page content can carry indirect prompt injection. Both abuse paths are tested against the tools the assistant can actually call.
RAG assistants over client files and matters must respect confidentiality between clients and between teams. Retrieval access control and exfiltration through rendered output are the priority tests.
Frequently asked questions
Do you work in UAE time?
Testing is remote from Europe, two to three hours behind Gulf Standard Time, so your whole working morning overlaps. Scoping and findings calls are scheduled in your working day.
Can you test Arabic-language chatbots?
Yes. Arabic attacks, Arabizi and mixed-language prompts are part of every assessment for a bilingual system, because that is where refusals are least consistent.
Our entity is in a free zone. Does that change the test?
It changes which data rules apply and therefore how findings are rated. A DIFC or ADGM entity is assessed against its own regime, and that is agreed in scoping.