Guide
Setting Up a Managed Cybersecurity or SOC Company in the UAE
The short answer
There is no single cybersecurity licence to point to. The licensing authority for your zone or emirate issues the commercial licence, while the UAE Cyber Security Council and the Telecommunications and Digital Government Regulatory Authority (TDRA) each decide matters within their own remit. What most often decides the route is whether the company will hold privileged access to customer systems and data, and under whose written authority.
Who decides, and what each authority covers
Three kinds of decision-maker sit around this business, and they do not overlap neatly.
The licensing authority for the zone or emirate approves the activity on the commercial licence. That is ordinary company formation. The choice between a mainland company and a free-zone route follows the customers you need to serve and where your analysts will sit.
The UAE Cyber Security Council and TDRA are separate from the licensing authority. Each decides what falls inside its own remit, and a commercial licence does not stand in for either. The exact current requirements are confirmed with each authority before any filing, not assumed.
The customer is the third decision-maker, and in practice often the strictest. Regulated customers and government-linked buyers set their own terms on staffing, clearance, data location and subcontractors. A licence that is valid on paper can still fail a customer's security due diligence.
If your plan extends to industrial control systems or critical infrastructure, read the OT and critical-infrastructure security guide as well. That work carries its own perimeter questions.
Pick the operating model first
The four models behave differently, so choose the one that most closely describes the plan before choosing a jurisdiction.
- Managed security operations centre. Continuous monitoring of customer environments. Highest data exposure, highest staffing load.
- Penetration testing and red-team services. Active testing of systems. The risk sits in the authorisation, not the tooling.
- Incident response and digital forensics. Evidence handling, chain of custody and, sometimes, contact with law enforcement.
- Security software with optional managed support. A product company that drifts into service delivery once customers ask for help running it.
Many founders start in one and add another later. Say so in the business plan now, because an activity description that fits only the first model can force an amendment.
Written authority and data handling
Two issues do most of the work in this sector.
Authority to test or access. Testing a system without precise written consent from its owner is the clearest way for a security company to create liability. The rules-of-engagement document defines which systems, which techniques, which dates and who at the customer can stop the work. Draft these templates before the first contract, not during it.
Personal and confidential data. Security telemetry looks technical, but it routinely carries usernames, IP addresses, email content and credentials. Treating it as non-sensitive is a common mistake. The UAE Government's page on data protection laws is the starting point for the federal and free-zone regimes. Which regime applies depends on where the company is established and where the data subjects and customers sit. Cross-border monitoring, where an analyst outside the UAE views a UAE customer's logs, needs a deliberate answer on transfer, access control and customer consent. Have lawyers licensed to practise in the UAE confirm the position for your exact set-up.
Substance, people and roles
A managed security company is a people business, and the company that signs customer contracts should employ the analysts, hold the tooling and carry the professional indemnity and cyber cover. An overseas parent or an intellectual-property company can sit elsewhere in the group, but each needs a genuine role.
Decide these before applying:
- Whether analysts sit in the UAE, offshore or both, and what each customer permits.
- Who vets analysts, and how access to customer credentials is granted, logged and revoked.
- Whether the company or the customer holds privileged credentials.
- Which subcontractors touch customer data, and how chain of custody is kept.
- Who is the named senior security and compliance lead.
Visa capacity follows headcount. A round-the-clock SOC needs shift cover, so plan against the real roster, not the founders alone. The business plan and supporting documents should show that roster and the delivery model behind it. Cost is built in layers, and the firm's fee is itemised in the engagement letter, as set out in how Velarozone works. For this sector the largest layer is usually payroll, tooling and insurance, not the licence.
What a bank looks at
Banks read a security company as a business that handles other people's data. Before you apply, be ready to show:
- Rules-of-engagement and consent templates.
- Analyst vetting and access-control procedures.
- Evidence handling and retention procedures.
- Incident-response playbooks and the commitments made to customers.
- Any certifications held and the assurance roadmap.
Customers and payment routes should match across the pitch, the financial model and the bank file. Corporate bank account readiness is easier when the delivery model is already written down. It does not guarantee an account.
What commonly goes wrong
- Testing without precise written authority. The scope was agreed in an email thread, and the customer later disputes what was covered.
- Treating telemetry as non-sensitive. Logs are stored or analysed somewhere the customer's contract does not allow.
- Offshore staffing against customer terms. A government-linked buyer requires local staff, and the delivery model assumed otherwise.
- Promising prevention. Contracts that promise to stop every attack are a liability. Measurable response commitments, such as time to triage, are defensible.
- No plan for unlawful activity found during work. The company discovers evidence of a crime and has no written procedure for who is told and when.
