Cybrilliant Talk to an Expert

SaaS and cloud provider cybersecurity in the UAE: In a software company, one stolen build credential reaches every customer.

Attackers use the common routes: an unpatched server, a stolen password, a trusted vendor. In a technology company, those routes can end at the build system, where one change reaches every customer who installs the next release.

Talk to an ExpertFollow the release ↓

Break in once at build time. Reach every customer at release.

After a breach that touches customer personal data.

  1. CodeA developer identity
  2. BuildThe build pipelineAttack point
  3. ReleaseSigned and shipped
  4. CustomersA release to customers
  • 43 daysThe median time to fully fix critical vulnerabilities on the CISA known-exploited list in 2025, across all industries, up from 32 days. A measure of exposure, not a rule.
  • 72 hoursThe controller must tell its EU authority within 72 hours of becoming aware, unless the breach is unlikely to put people at risk. Your customer needs your notice quickly.

Where the exposure sits in a technology company

  1. A way in

    An unpatched server, a stolen password, a phish to an engineer.

    31%of breaches across all industries began with exploitation of vulnerabilities, now the most common way in (Verizon DBIR 2026)
  2. A developer identity

    Not only domain administrators. Engineers who can merge code, approve releases or read production secrets, and the contractors and bots that hold the same rights.

  3. The build pipeline

    Source repositories, build runners, package registries and the secrets stored in them. This is where code becomes the product.

  4. A release to customers

    What gets signed and shipped, and who can change it on the way. A bad build reaches every customer, and the data each customer holds in it.

What changes for a technology company

The same security decision gets a different answer when your product is software that other companies run.

Who to protect first

Domain and cloud administrators.

Engineers who can merge code and approve releases, the build service accounts, and anyone who can read production secrets.

How to rank suppliers

By spend, or by the data they hold.

By what they can change in your product: packages, build actions, SDKs and the cloud accounts your release runs in.

What recovery means

Restore the systems from backup.

Rebuild from clean source and a clean pipeline, rotate every secret the pipeline held, and re-sign what you ship.

When to report

When the facts are clear.

As soon as customer data may be involved. Your customer’s deadline may depend on your call, so name who makes it.

Proving security

One audit a year.

One evidence set that answers SOC 2, ISO 27001 and each customer questionnaire, kept current between audits.

Customers and standards set the clock

Software companies are rarely held to one sector regulator. What binds in practice is data protection law, customer contracts and the standards customers ask you to prove.

UAE data law reaches you

The PDPL (Federal Decree-Law 45 of 2021) covers UAE controllers and processors, and foreign ones handling data of people in the UAE. Article 9 requires breach notice to the UAE Data Office. Free zones with their own data law sit outside it.

Customers set your duties

Under the PDPL, a processor follows the controller’s instructions, protects the data, erases it after the agreed period and proves compliance on request (Article 8). In a SaaS contract you are usually the processor.

Customers ask for proof

SOC 2 reports come from an independent CPA firm. ISO/IEC 27001:2022 sets requirements for an information security management system. Neither is a law, but customers and their auditors often ask for one.

Rules and frameworks behind this page

UAE PDPL (Federal Decree-Law 45 of 2021)

Sets duties for controllers and processors, including breach notice to the UAE Data Office under Article 9.

Read the source

Source: UAE Legislation portal, Federal Decree-Law 45 of 2021; European Commission data breach rules; AICPA; ISO; Verizon DBIR 2026. This is analysis, not legal advice.

UAE rules, by who you are

Which UAE rule reaches a cloud, SaaS, data-centre or digital provider

A technology firm is bound by the data law of the entity that processes the data, and by the standards of the customers it chooses to serve. DESC standards bind cloud and SOC providers who serve Dubai government. They do not bind every private provider.

  • Binding law
  • Regulator rule
  • Standard or policy
  • Contract term

Mainland controllers and processors of personal data

Federal

Binding lawFederal Decree-Law No. 45 of 2021 (PDPL), Articles 20 and 21, subject to scope and exclusions.

Article 20 asks for suitable technical and organisational measures. They must protect the confidentiality, safety, accuracy and resilience of processing systems, restore access after a failure, and test whether the safeguards work. High-risk processing can require a data protection impact assessment under Article 21.

Confirm: Article 20 does not itself set a universal yearly penetration test.

Cloud providers serving Dubai government and semi-government

Dubai

Standard or policyDESC Cloud Service Provider (CSP) Security Standard.

DESC states compliance is mandatory for cloud providers who want to offer cloud services to these entities. Certification has yearly surveillance audits where possible and recertification every three years.

Data-centre providers and managed digital infrastructure in Dubai

Dubai

Standard or policyDESC data centre and SOC standards where they are relevant to the service and customer. CIIP if designated.

Confirm the exact DESC standard and certification scope. Do not assume a private provider must meet a government-facing standard if it does not serve that customer group.

Critical digital infrastructure and hosting providers

Federal

Regulator ruleCIIP and UAE Information Assurance standard, where designated, with sector rules.

Designated entities apply UAE IA across the information, systems and processes in scope. Confirm designation and the sector plan. Not every data centre is critical.

This is analysis, not legal advice. Data-protection law is not one regime in the UAE: the federal PDPL, ADGM and DIFC each have their own. A security duty does not by itself create a yearly penetration test. Confirm which regime and standard apply to each entity and data set with your counsel.

What a technology company asks us first

Check our build pipeline

Review who can change source, what secrets the build holds and what is allowed to sign a release.

Compare us with NIST SSDF

Map current practice to NIST SP 800-218 and SLSA, and list the gaps.

Rehearse a bad release

Run a table-top on a tampered build: who pulls it, who tells customers, how secrets are rotated.

Build one evidence set

Align SOC 2, ISO 27001 and customer questionnaire answers to a single set of controls.

If you also operate in the US, the UK, India or Australia

UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.

Standards that follow your data, not your sector

Card, privacy, resilience and assurance standards reach a technology company through what it handles and who it serves. Each card says what kind of rule it is and when it applies. This is not a full list. Check scope with your own counsel.

  • Buyer requirement
  • Voluntary certification
  • Law
  • Card brand rule
  • Buyer requirement

    SOC 2

    AICPA System and Organization Controls 2

    The report enterprise buyers ask a software or cloud provider for first.

    An auditor’s report on a provider’s controls for security, availability, processing integrity, confidentiality and privacy. No law requires it. Many buyers do.

    Source: AICPA, SOC suite of services
  • Voluntary certification

    ISO/IEC 27001

    Information security management systems

    Certification is optional. Many buyers ask for it.

    The 2022 edition is current. Certification is the organization’s choice, not a requirement of the standard.

    Source: ISO, ISO/IEC 27001
  • Law

    GDPR

    EU General Data Protection Regulation

    Processor duties when you handle personal data for customers covered by the GDPR.

    A controller notifies the authority within 72 hours of becoming aware of a breach, unless it is unlikely to risk people’s rights (Art. 33).

    Source: EUR-Lex, Regulation (EU) 2016/679
  • Law

    NIS2

    EU Network and Information Security Directive 2

    Cloud, data centre, managed service and managed security service providers in the EU.

    Member States had to transpose it by 17 October 2024. In July 2026 the Commission referred four states to the Court of Justice for failing to notify their measures.

    Source: European Commission, NIS2 Directive
  • Law

    DORA

    EU Digital Operational Resilience Act

    You serve EU financial entities as an ICT provider.

    Applies from 17 January 2025. Major ICT incidents go to the authority in stages: initial, intermediate and final report.

    Source: EUR-Lex, Regulation (EU) 2022/2554
  • Buyer requirement

    FedRAMP

    US Federal Risk and Authorization Management Program

    You sell cloud services to US federal agencies.

    Two routes run side by side: Rev. 5 and the newer 20x. The 20x moderate pilot closed in May 2026. High impact still goes through Rev. 5.

    Source: FedRAMP
  • Law

    HIPAA

    US Health Insurance Portability and Accountability Act, Security Rule

    You handle health data for a US covered entity as a business associate.

    A rewrite was proposed on 6 January 2025. As of June 2026 it is not final, and the current Security Rule stays in force.

    Source: US HHS, HIPAA Security Rule
  • Card brand rule

    PCI DSS

    Payment Card Industry Data Security Standard

    You store, process or transmit card data for customers.

    Version 4.0.1 is current. Version 4.0 retired on 31 December 2024. The newer requirements have applied since 31 March 2025.

    Source: PCI Security Standards Council
48%

Of breaches across all industries involved a third party (Verizon DBIR 2026)

Where we would start with a technology company

Protect What MattersReview who can change source, what secrets the build holds and what can sign a release.Application Security, Identity & Access Security, Cloud SecuritySecure & ComplyTurn SOC 2, ISO 27001 and customer questionnaires into one evidence set with owners.Compliance Assessments, Audit Readiness, Third-Party & Supply-Chain RiskDetect, Respond & RecoverRehearse a tampered release: pull it, tell customers, rotate secrets and rebuild.Incident Response, Crisis Management, Breach Response

What to read before you talk to us

Industry BriefIndustry Brief: Technology Company Cyber Risk PrioritiesWhy a technology company’s weakness becomes its customers’ incident.
ArticleSecrets Management in Modern Application EnvironmentsSecrets in build systems: how many you hold, how long they live, who can reach them.
Threat IntelligenceSupply-Chain Compromise: From Vendor Trust to Enterprise ImpactHow an attack arrives through access you granted on purpose.
ArticleWhy Application Security Fails at the HandoffWhere application security breaks: the handoff from finding to fix.
ArticleAI Supply-Chain Security: Models, Data and DependenciesModels, data and dependencies you did not write, and what to track.

Sources and method. This page is analysis, not legal advice.