A regional office serving the Gulf
Unlike some of the regions PentestOps serves, the Middle East has a real Extranet Systems office behind it. Middle East Operations sits at Building 869, Road 3618, Block 436, Office 22, Seef Area, Bahrain, and covers sales, operations and support for customers across the United Arab Emirates, Saudi Arabia, Qatar, Kuwait and the wider Gulf. It is the only office we have anywhere in the Middle East, and we do not claim any other.
That local presence sits alongside a Wollongong, Australia head office and a Sydney sales and operations office, plus a Cairo, Egypt office serving North Africa. Extranet Systems operates across three continents, Oceania, Asia and Africa, and the Bahrain team is a genuine part of that footprint rather than a reseller or a partner brand.
Testing itself still runs as software, whether or not a region has a local office. External testing needs no agent at all. Internal testing uses an on-premise agent your own team installs as a Docker container, RPM or DEB package in about 5 minutes, connecting outbound-only over TLS 443 with 0 inbound firewall rules and no VPN. One host can cover multiple subnets, which suits groups with sites across several Gulf countries.
What the Bahrain office is, and what it is not
This is the fact we want stated plainly rather than buried in a schedule: having an office in Bahrain does not mean your data is stored in Bahrain, or anywhere else in the Middle East. The Bahrain team handles contracts, scoping calls, account management and support. It is not a data centre, and no scan data, findings or evidence are hosted there.
The platform is hosted in Australia on infrastructure operated by Extranet Systems. Customer data is stored in Australia for every Middle East customer, exactly as it is for every other region we serve, regardless of whether that region has a local office. Read that alongside the rest of this page before you shortlist us, because it is a decision your privacy and procurement teams should make with the facts in front of them, not assume from the existence of a regional address.
Support for Middle East customers is provided from Australia, Bahrain and our Cairo office, which extends live coverage further into Gulf business hours than an Australia-only team could manage on its own. Support staff in each of those locations work against the same Australian-hosted platform and access the same underlying data from wherever they are, which is disclosed in full in our Trust Centre.
Extranet Systems Pty Ltd is ISO/IEC 27001:2022 certified, independently audited by Atom Assurances. The platform is built to SOC 2-aligned controls, and a SOC 2 attestation is on our roadmap. Every customer runs in an isolated environment with its own dedicated database, data is encrypted at rest, traffic is protected with TLS in transit, and audit logs are retained for 365 days. You are the data controller and Extranet Systems is the data processor; a signable DPA is available on request. Enterprise customers can request specific data-residency arrangements, or the on-premise deployment option that keeps scan data inside your own boundary.
What gets tested
Every engagement runs the same seven phases, grounded in PTES, the OWASP Web Security Testing Guide v4.2 and NIST SP 800-115, and aligned to CREST testing methodology guidance. Signed Rules of Engagement authorise each scan and each exploitation attempt, and scope enforcement stops anything that reaches outside the assets you listed.
- Perimeter. 24+ external recon modules map the internet-facing surface, including services stood up years ago and never retired. See external network testing.
- Internal network. With the on-premise agent in place, 18+ internal modules execute on the LAN itself rather than tunnelling every packet back to a remote scanner. See internal network testing.
- Applications and APIs. REST and GraphQL coverage against OWASP Top 10 and API Top 10 risks, with findings streaming live during the scan.
- Cloud. 800+ automated checks across AWS, Azure, GCP and M365 against CIS Benchmarks, plus an agentless Kubernetes audit run from a read-only kubeconfig.
- Identity. Active Directory enumeration, credential testing and password-policy auditing establish what one ordinary account can reach once somebody else is using it.
- Prioritisation. CVE correlation, CVSS v3.1 scoring, exploit-availability indicators and CISA KEV flags, which matters most when a lean regional team owns the whole estate.
What drives testing across the Gulf
The trigger for testing across the Middle East usually comes from outside the security team: a regulator, a bank's due-diligence process, a customer questionnaire, or a group parent company setting a baseline across every market it operates in. Testing does not make an organisation compliant with anything, and we will never say it does. What it supplies is technical evidence of what is reachable, what is exploitable, how far an attacker gets, and what to fix first.
| Middle East context | Where testing usually starts |
|---|---|
| Banks, insurers and other regulated financial institutions across the Gulf | External perimeter and internal network testing, then continuous coverage between independent assessments |
| Government and critical-infrastructure operators in Saudi Arabia, the UAE and Qatar | Perimeter discovery and identity testing, with evidence you can carry into each regulator's own review |
| Organisations handling personal data under UAE, Qatar or Bahrain data protection law | Which reachable paths lead to systems holding personal data, and how far an attacker gets before detection |
| Merchants and payment platforms in scope for PCI DSS v4.0 | Web application and API testing across OWASP Top 10 and API Top 10 risks, re-run after each release |
| Multinational groups running Gulf operations alongside an Australian or Asia-Pacific parent | One platform covering every market, with consistent methodology and comparable reporting |
Regulatory landscape across the region
The Middle East is not one regulatory environment. Saudi Arabia, the UAE, Qatar, Bahrain and Kuwait each run their own cybersecurity and data protection rules, and a Gulf-wide group is usually answering to several of them at once. None of these regimes is a certification you can buy, and none is satisfied by running a scan.
Keep the boundary clear. These national frameworks are not among the 8 compliance reporting frameworks PentestOps maps findings to. Testing supplies technical evidence you can carry into a regulatory review; it does not replace legal advice, and we will not tell you it does. Take your own advice on how a given framework applies to your organisation.
| Regional framework | Who it reaches | What testing can evidence |
|---|---|---|
| Saudi Arabia's National Cybersecurity Authority Essential Cybersecurity Controls (ECC) | Saudi government entities and the critical infrastructure operators bound by them | Patch currency, exposed services and hardening gaps on in-scope systems, with evidence attached to every finding |
| Gulf central bank cybersecurity requirements (Saudi Central Bank, Central Bank of Bahrain, Qatar Central Bank, UAE Central Bank) | Banks, insurers and other regulated financial institutions | Perimeter, internal network and application testing evidence to support the technical control reviews these frameworks expect |
| UAE, Qatar and Bahrain personal data protection law | Organisations whose processing of personal data falls within those jurisdictions' data protection laws | Which reachable paths lead to systems holding personal data, and how far an attacker gets before detection |
| Cross-border hosting review | Privacy officers and procurement teams assessing an Australian-hosted platform from the Gulf | The documented facts to assess: data stored in Australia, an ISO/IEC 27001:2022 certified processor, encryption at rest, TLS in transit, 365-day audit logs and a signable DPA |
Getting started from the Middle East
The Bahrain team can walk you through scoping in Gulf business hours, but nothing about onboarding requires a visit. You can authorise scope, add assets and run a real scan the same day you sign up. See continuous penetration testing for how the ongoing cadence works once the first assessment is done.
- Authorise the scope. Sign the Rules of Engagement covering assets you own or are authorised to test. Scope enforcement stops activity outside them automatically.
- Add assets. A public IP, hostname, web application, internal subnet target, cloud account or Kubernetes cluster each count as one asset. Bulk CSV or XLSX import is available for larger estates.
- Run the perimeter first. External testing needs no agent, so you see the internet-facing surface before touching the internal network.
- Deploy the agent for internal scope. Docker, RPM or DEB, about 5 minutes, outbound-only over TLS 443. See the agent.
- Set a cadence. Scheduled scans and scheduled perimeter re-checks on the Professional and Enterprise plans, plus drift detection, keep coverage current between assessments.
Being straightforward about the trade-off
If your organisation has a firm requirement that security data physically stay inside the Middle East, our standard offering does not meet it, and having a Bahrain office does not change that answer. Enterprise customers can discuss specific data-residency arrangements or the on-premise deployment option with us; anything else is a conversation, not a checkbox.
If Australian hosting works for your risk position, the trade generally favours you: an ISO/IEC 27001:2022 certified vendor with a genuine regional presence for sales and support, asset-wise pricing with scans unlimited within fair use, exploit-validated findings rather than a severity list, AI analysis that is self-hosted by default so scan data is not sent to third-party model providers, and reports mapped to 8 compliance reporting frameworks (OWASP Top 10, PCI DSS v4.0, NIST 800-53, SOC 2, HIPAA, GDPR, ISO 27001, SMB1001) plus CIS Benchmarks for AWS, Azure, GCP and Kubernetes.
Support runs Mon-Fri 9am-6pm AEST, with 24/7 support for Enterprise customers. The Bahrain and Cairo teams extend live coverage further into the Gulf working day than an Australia-only team could, though scans, alerts and reporting run at any hour on the schedule you set, regardless of support hours.
Company and contact details
For the procurement file: PentestOps is a product of Extranet Systems Pty Ltd, an Australian company with ABN 29 632 743 189, headquartered at 77 Market Street, Wollongong NSW 2500, Australia. Middle East Operations is at Building 869, Road 3618, Block 436, Office 22, Seef Area, Bahrain. Reach us on the Australian number, +61 1300 290 196, or through contact.