WebSec FZCO, Dubai
The cybersecurity company you are actually hiring
RedTeam Security is the trading brand of WebSec FZCO, licensed in Dubai Silicon Oasis. There are no biographies on this page. There is the bar every operator clears, what happens to the evidence an engagement produces, and the entity facts your procurement team needs. Published as policy, not as marketing.
Four conditions, cleared before we start
This is a staffing policy rather than a team page. It is written down because the phrase "certified professionals" carries no information on its own, and because a buyer is entitled to know what the person inside their network had to prove first. All four apply to every operator, on every engagement.
01
OPS-01
MandatoryA certificate of good conduct, and screening that repeats
A certificate of good conduct is a condition of joining. Screening is then repeated on a regular cycle rather than performed once at hire and filed away.
Why this bar exists. An operator handles recovered credentials, session material and a written account of exactly where your defences are thin. A check made on the day someone was hired says nothing about the years that follow, which is where the risk actually sits.
02
OPS-02
MandatoryA bachelor's degree in an IT field
A formal grounding in information technology, held before any offensive certification is counted toward the standard.
Why this bar exists. Offensive certifications teach attack technique against systems that are assumed to be understood already. The degree is where that understanding comes from: how networks, operating systems, identity and applications are supposed to behave. It is what lets an operator tell a real weakness from noise, and it is what makes the remediation conversation with your engineers worth having.
03
OPS-03
MandatoryA minimum of four years in hands-on offensive work
Nobody works a client estate with less than four years of practical experience behind them. Newer staff work under supervision, on research and on internal targets.
Why this bar exists. Judgement under production conditions is the part no exam can certify. Knowing when to stop short of a control that would disrupt a live service, when a lead is worth the hours left in the window, and when to raise the deconfliction channel instead of pressing on is learned on real estates over years. That judgement is the difference between an engagement that produces findings and one that produces an incident.
04
OPS-04
MandatoryAt least two certifications, drawn from a fixed list
Every operator holds two or more of OSCP, OSWE, OSEP, OSED, OSCE3, CRTO and CRTL, and the pair has to be relevant to the work being staffed.
Why this bar exists. One certification proves one shape of skill. Two, taken from a list spanning network exploitation, web application source review, evasion, exploit development and engagement leadership, is what turns specialists into a team that can carry an objective the whole way. The list is fixed so that staffing is a check against a document rather than an opinion.
OPS-04 · the accepted list
Seven certifications, and what each one proves
OSCP is the most widely recognised of these, and hiring OSCP certified penetration testers in the UAE is where this list starts rather than where it ends. The six that follow cover the ground an engagement crosses after initial access, which is ground a scan-and-report exercise never reaches.
- OSCP
- Offensive Security Certified Professional. Hands-on exploitation across a live network, examined by doing rather than by multiple choice.
- OSWE
- Offensive Security Web Expert. White box exploitation of web application source code, which is where the flaws a scanner cannot see are found.
- OSEP
- Offensive Security Experienced Penetration Tester. Evasion and lateral movement inside environments that are actively defended.
- OSED
- Offensive Security Exploit Developer. Windows user mode exploit development, the skill behind the CVE numbers in our research.
- OSCE3
- Offensive Security Certified Expert 3. Web exploitation, exploit development and evasion held together in one credential.
- CRTO
- Certified Red Team Operator. Red Team infrastructure and operational tradecraft, including command and control that is built to stay quiet.
- CRTL
- Certified Red Team Lead. Directing a full engagement: scenario design, deconfliction and the decisions the rest of the team works to.
Certified as a company
The four conditions above say who is on the job. These three are audited against the company that employs them, which is the part a procurement questionnaire asks about.
ISO 27001
Information security management, certified at the company level. It is the system the evidence policy below is run under.
ISO 9001
Quality management, which is what keeps delivery repeatable when the staffing changes.
CVE numbers assigned to our research
Responsible disclosures published
Company certifications held
Those numbers come from vulnerability research published under coordinated disclosure, in products other people ship. It is the same practice that staffs the engagements, which is what keeps the tradecraft current.
What we hold, and for how long
An engagement produces the most sensitive document that will ever exist about your estate: a working account of how to get inside it. Every provider in this market creates that document. None of them publish what happens to it afterwards. This is our policy, and it is the same policy on every engagement.
01 Capture
What an engagement produces
Screenshots and command transcripts proving each step, credential material recovered along the way, logs from the command and control infrastructure and the tooling, a small proof sample of whatever the objective exposed, and the draft narrative that becomes your report. The aim is proof of access, so a sample is taken and a data set is not.
02 Custody
Where it is held
In an encrypted store run under our ISO 27001 information security management system, on infrastructure stood up for your engagement and used for nothing else. Not on personal devices, not on a general purpose file sharing account, and never in the same place as another client's material.
03 Access
Who can reach it
The operators staffed on your engagement and the engagement lead, by named account, and nobody else in the company by default. Access ends when the engagement ends. Your white team receives the material through the channel written into the rules of engagement, and that is the only route it travels.
04 Closure
What is destroyed at clean closure
On your side, every artefact we placed in the estate is listed and removed: implants, accounts, scheduled tasks, files and any infrastructure pointed at you. On ours, recovered credential material, proof samples and raw session data are destroyed once the report has been accepted.
05 Retention
What is kept for the retest window
Only what a retest needs in order to verify a fix: the findings record, the attack path and the technique mapping. It is held for the retest window agreed in your contract and destroyed at the end of it, unless you ask us in writing for something different.
06 Disclosure
What never leaves
An NDA is signed before you describe your estate on a scoping call, not after. Client-identifying material never appears in our marketing, which is why this site carries no client names, no logos and no case studies. The absence you are reading is the policy working.
Ask for the destruction record. Confirmation of what was removed from your estate and what was destroyed on our side is part of closing an engagement, not a favour. If your own retention rules are stricter than this policy, they go into the rules of engagement and they win.
What procurement needs
A UAE enterprise buyer cannot raise a purchase order from a services page. They need the legal entity, a registered address, an engagement model and a duration, and normally they sit through a call to get them. They are published here instead.
| Legal entity | WebSec FZCO |
|---|---|
| Trading brand | RedTeam Security, the name every engagement is delivered under |
| Registered address | IFZA Business Park, Building A2, Nadd Hessa, Dubai Silicon Oasis, Dubai, United Arab Emirates |
| Area served | United Arab Emirates and the wider GCC, delivered remotely or on site |
| What we deliver | Red Team engagements, adversary simulation, assumed breach, penetration testing, Purple Teaming and social engineering testing. The six, in detail |
| Engagement model | Objective-based and scoped individually against a named crown jewel. No packages and no per-asset price list |
| Typical duration | 6 to 10 weeks, from scoping and rules of engagement through to the Purple Team debrief |
| Pricing | Quote only, set by the objective, the scope and the size of the estate around it |
| Contact | [email protected] |
Vendor onboarding packs, registration documents and supplier questionnaires are completed directly with your procurement team by email rather than published on a web page. Send the pack to [email protected] and it comes back filled in.
A Dubai base, a wider map
The company works out of IFZA Business Park in Dubai Silicon Oasis. Engagements run remotely or on site across the United Arab Emirates and the wider GCC, on the working week your organisation actually keeps, which for a Sunday to Thursday business is not a small detail during a live operation. The base is where the company is registered, not the limit of where it operates: work runs into Europe and the United States on the same terms.
Being based here changes what an attack path looks like on paper. The regulators you answer to, the shared service providers common across the region and the supplier relationships already sitting inside your perimeter are the ones we work against week to week. Engagements are structured to support the Central Bank of the UAE, DESC, UAE IAS and ADHICS, and the reporting is written so a regulator's question can be answered out of it. An engagement in Europe or the United States is structured against whichever framework that engagement answers to, on the same methodology.
We do not describe ourselves as an approved provider of any of these regimes, and no engagement is sold as a certificate against one.
Let's talk about your security
Tell us the objective you want tested. We reply with a scope, a timeline and a quote.