Key takeaways
- CBUAE's Cyber Resilience Standard tiers licensed financial institutions and requires adversarial testing at the highest assurance tier.
- The UAE Information Assurance Regulation requires periodic assurance for federal entities, including adversary simulation at the applicable control level.
- DESC binds Dubai government entities and their suppliers to security testing obligations that include adversary simulation for critical systems.
- ADHICS requires Abu Dhabi healthcare providers to conduct threat-led security exercises for systems that handle patient data at the highest classification.
- ADGM/FSRA and DFSA each maintain their own cyber resilience frameworks and both expect adversarial testing for systemically important firms in their jurisdictions.
What regulators mean when they name threat-led testing
A penetration test finds exploitable weaknesses against a defined scope. An adversary simulation goes further: a realistic adversary, built from threat intelligence, pursues a named objective across your live environment without a fixed scope boundary. The difference matters to regulators because a scoped test can pass while the controls that face your actual adversaries remain untested.
When a regulation names threat-led testing, it asks for evidence that a realistic attacker was simulated, that the controls designed to stop them were exercised, and that the findings were remediated. The red team engagement that satisfies that ask is built on a threat profile, runs across the full kill chain, and produces a report an auditor can read against the control framework it is tied to.
Four regimes in the UAE name this class of testing directly. Two more, the ADGM/FSRA and DFSA frameworks, apply to financial firms in the Abu Dhabi Global Market and the DIFC and align closely with the CBUAE approach. Understanding what each requires before you commission an engagement avoids a common mistake: an engagement run for the wrong regulator's evidence model.
Plan
Threat profile
Adversary TTP set drawn from intelligence
Scenario design
Objectives mapped to the regulatory ask
Execute
Initial access
Phishing, supply chain, or perimeter
Full kill chain
In, Through, Out against live controls
Report
Findings and evidence
What fired, what did not, with proof
Compliance baseline
Control gaps mapped to the framework
CBUAE: tiered requirements for licensed financial institutions
The Central Bank of the UAE issued its Cyber Resilience Standard for Licensed Financial Institutions in 2021. The standard classifies institutions into three tiers based on systemic importance and asset size. Tier 1 covers systemically important banks, major clearing institutions and exchange houses with the largest balance sheets. Tier 2 covers mid-sized licensed institutions. Tier 3 covers smaller licensed entities. The assurance requirements scale with the tier: Tier 1 institutions face the most demanding controls, which at the highest assurance level include regular adversarial testing built on a documented threat intelligence basis.
The standard ties the required testing depth to the institution's control maturity level. An institution at the highest control tier is expected to move beyond vulnerability scanning and periodic penetration testing to exercises that simulate a realistic adversary pursuing a business objective. The standard names threat intelligence as the required input to scenario design, which is the defining characteristic of adversary simulation over a standard red team. A Tier 1 institution that relies on a single annual penetration test will not satisfy the highest-tier assurance requirement.
The link to how an adversary simulation is planned is direct: the threat profile the CBUAE expects is the same document that anchors the simulation scenario. An engagement that cannot show its intelligence source and the adversary model it produced cannot satisfy the standard's demand for a threat-led approach.
| Regulator | Who it binds | Requirement level | Evidence expected |
|---|---|---|---|
| CBUAE | Licensed banks, exchange houses, payment firms nationwide | Adversarial testing at Tier 1 assurance level | Threat profile, kill chain log, control gap map |
| NESA / UAE IAS | Federal ministries and critical infrastructure operators | Periodic assurance at the applicable control tier | Test scope, findings report, remediation plan |
| DESC | Dubai government entities and their direct suppliers | Security testing for critical and sensitive systems | Test record, findings, remediation evidence |
| ADHICS | Abu Dhabi healthcare providers handling patient data | Threat-led exercises for highest-classification systems | Risk register update, test report, remediation record |
| ADGM / FSRA | Financial firms licensed in Abu Dhabi Global Market | Cyber resilience testing aligned to FSRA guidance | Threat intelligence basis, test report, board attestation |
| DFSA | Financial firms licensed in DIFC | Periodic adversarial testing for systemically important firms | Test report, remediation evidence, board sign-off |
NESA and the UAE Information Assurance Regulation
The UAE Information Assurance Regulation, issued by NESA and now administered by TDRA, applies to federal ministries and critical national infrastructure operators. It specifies control baselines and assurance activities by information classification level. Systems classified at the highest levels are expected to undergo periodic assurance activities that go well beyond a vulnerability scan.
The regulation does not prescribe a specific testing methodology by name, but the assurance activity it describes at the highest classification level corresponds to what an infrastructure pentest and a full adversary simulation together cover. Operators subject to the UAE IAS should map their classified systems to the applicable control tier and commission testing at the depth that tier requires. A documented scope, a test report and a remediation plan are what the regulation expects to see.
DESC for Dubai government entities and their suppliers
The Dubai Electronic Security Centre issues the Dubai Information Security Regulation, which applies to Dubai government entities and any supplier that processes or stores their data. The regulation sets security testing obligations for critical systems. For systems that handle sensitive government data or support essential services, the expected testing depth aligns with what an adversary simulation delivers: a realistic threat actor pursuing an objective against live controls.
Supplier scope is the point most organisations miss. A private company holding a contract with a Dubai government entity is inside DESC's boundary for the data it handles under that contract. If the contract involves critical systems or sensitive data, the testing obligations apply to that part of the supplier's environment. The detection coverage findings from a simulation are exactly the evidence DESC expects: not a list of open ports but a record of which controls fired and which stayed silent across the kill chain.
ADHICS for Abu Dhabi healthcare providers
The Abu Dhabi Health Information and Cyber Security standard, issued by the Department of Health Abu Dhabi, applies to all healthcare providers licensed in Abu Dhabi. ADHICS classifies information assets and sets security controls by classification level. For assets that handle patient data at the highest classification, ADHICS expects threat-led security exercises to be conducted periodically and the findings to feed into the organisation's risk register.
Healthcare environments have one constraint adversary simulation has to respect: clinical systems cannot be disrupted, and some testing must run in a parallel environment or stop short of active exploitation. ADHICS permits scoped exercises that simulate the adversary path without disrupting clinical systems. An assumed breach engagement, which starts from a granted foothold rather than a live phishing attempt, satisfies the testing intent while protecting uptime. The findings must still be documented, remediated and recorded for the next review cycle.
What a regulatory-grade adversary simulation report must contain
An engagement that cannot be read by an auditor has not satisfied the regulation. The report is the evidence, and its structure matters as much as its findings. A regulatory-grade report opens with the threat profile: who the simulated adversary was, what intelligence described them, and what their objective was. Without that section, an auditor cannot confirm the engagement was threat-led rather than a standard red team run without an intelligence basis.
The findings section must follow the kill chain. Each stage of the engagement, from initial access to objective, carries its own findings block: what was tried, what succeeded, which control responded and which did not. The control gap map closes the report by tying each gap to the control framework the regulator reads. For a CBUAE-bound institution, that is the Cyber Resilience Standard tier. For a DESC entity, it is the Dubai Information Security Regulation control set.
The article on how to buy an adversary simulation covers what to ask a provider before commissioning. The report structure is the most important check: ask to see a redacted sample before signing and confirm it addresses the regulator's control language directly rather than a generic risk framework. Purple teaming can follow an adversary simulation and convert the detection gaps the simulation found into detection rules the SOC owns.
Threat profile
Intelligence basis and adversary objectives
Kill chain narrative
Per-stage findings, what succeeded and what did not
Control response log
What fired, what stayed silent, with timestamps
Control gap map
Gaps mapped to the regulatory framework tier
Remediation plan
Ownership, priority and dates for each gap
Adversary simulation requirements across the UAE market
The UAE security testing landscape splits along jurisdictional and sector lines. The CBUAE governs all licensed financial institutions nationally, including banks headquartered in Dubai and Abu Dhabi. Its Cyber Resilience Standard is the most detailed adversarial testing framework in the market, and Tier 1 institutions in both emirates are subject to its highest assurance requirements.
Dubai adds DESC's Dubai Information Security Regulation on top of any sector-specific regime. A Dubai government entity or its supplier faces DESC obligations in addition to any CBUAE or other sector framework that applies. The DIFC, which operates within Dubai, adds the DFSA framework for its licensed firms. A Dubai-based financial institution may face requirements from two regulators at once.
Abu Dhabi has its own layering. ADHICS applies to healthcare providers licensed in the emirate. The ADGM, operating within Abu Dhabi, adds the FSRA cyber resilience framework for its licensed financial firms. Federal entities in Abu Dhabi, including ministries and critical infrastructure operators, also fall under the NESA Information Assurance Regulation administered by TDRA.
Free-zone entities are not exempt from sector regulation. A bank licensed under the CBUAE but operating from a Dubai free zone such as Dubai Silicon Oasis remains bound by the Cyber Resilience Standard. A healthcare provider in Abu Dhabi's free zones remains bound by ADHICS for patient data. The regulator that matters is the one that issued the operating licence, not the free zone authority.
Frequently asked questions
What is an adversary simulation under UAE regulation?
An adversary simulation is a security exercise in which a realistic threat actor, modelled on threat intelligence, pursues a named business objective across your live environment. Under UAE regulation, it is the testing form that satisfies the highest assurance tier in frameworks such as the CBUAE Cyber Resilience Standard, because it exercises the controls that face your actual adversaries rather than a defined technical scope.
Does the CBUAE require adversary simulation for all licensed financial institutions?
No. The CBUAE Cyber Resilience Standard tiers institutions by systemic importance and asset size. The requirement for adversarial testing at the highest assurance level applies to Tier 1 institutions: systemically important banks, major clearing institutions and large exchange houses. Tier 2 and Tier 3 institutions face less stringent assurance requirements, though the standard expects all licensed institutions to conduct security testing proportionate to their risk profile.
How does adversary simulation differ from a red team engagement under UAE regulatory requirements?
Both are adversarial exercises, but an adversary simulation is specifically threat-intelligence-led: the threat profile is built from intelligence that describes your actual adversaries, and the scenario is designed around that profile. A red team engagement may use the same techniques without a documented intelligence basis. Regulators such as the CBUAE name threat-led testing because the intelligence basis is what distinguishes a simulation from an exercise that tests a generic attacker with no relevance to your sector.
What evidence does the CBUAE expect from an adversary simulation?
The CBUAE Cyber Resilience Standard expects a threat profile documenting the intelligence basis and adversary objectives, a kill chain narrative recording what was attempted and what succeeded at each stage, a control response log showing which controls fired and which did not, and a control gap map tied to the relevant standard tier. A report that presents findings as a vulnerability list without the control gap map will not satisfy the regulatory requirement.
Does DESC apply to private companies in Dubai?
DESC's Dubai Information Security Regulation applies to Dubai government entities and to private companies that process or store government data under a contract. A supplier with a contract that involves critical systems or sensitive government data is inside DESC's boundary for that part of its environment. The testing obligations apply to the data and systems in scope for the contract, not to the supplier's entire estate.
What does ADHICS require for adversary simulation in Abu Dhabi healthcare?
ADHICS requires threat-led security exercises for information assets at the highest classification level. For healthcare environments, it permits scoped exercises that simulate the adversary path without disrupting clinical systems. An assumed breach engagement, which starts from a granted foothold, is one approach that satisfies the testing intent. The findings must feed into the risk register and a remediation record must follow for the next review cycle.
Do ADGM and DIFC financial firms face adversary simulation requirements?
Both ADGM/FSRA and DFSA maintain cyber resilience frameworks that include adversarial testing requirements for systemically important firms in their respective jurisdictions. The FSRA framework aligns closely with the CBUAE approach. DFSA expects periodic adversarial testing with a report, remediation evidence and board sign-off. Firms licensed in either centre should review the applicable cyber resilience guidance and confirm their testing programme matches the required depth.
How does adversary simulation satisfy the NESA Information Assurance Regulation?
The UAE IAS specifies assurance activities by information classification level. At the highest classification, the required assurance depth corresponds to what an adversary simulation delivers: a realistic adversary pursuing a business objective against live controls, with a documented scope, findings report and remediation plan. Organisations subject to the UAE IAS should map their classified assets to the applicable control tier and commission testing at that depth.
