Frequently asked questions

CyberWhy is an international cybersecurity provider. We help organizations find weaknesses, protect their systems, respond to incidents, build a security strategy and prepare their people. Our services are penetration testing, vulnerability assessment, incident response and forensics, cyber security consulting, system protection and security awareness training.

We work with organizations of different sizes and sectors, for example financial services, healthcare, retail and e-commerce, manufacturing, professional services, hospitality, logistics, and construction and engineering. The scenarios on our service pages are illustrative: they describe typical situations and are not CyberWhy client engagements.

Start with a conversation. Use the contact page or write to info@cyberwhy.com and tell us what you are working on and what you need to protect. We will come back to you to understand your situation and suggest the right service and next step.

• Penetration Testing
• Vulnerability Assessment
• Incident Response and Forensics
• Cyber Security Consulting
• System Protection
• Security Awareness Training

No. The contact form has a "Not sure yet" option. Describe your goals, your systems and what worries you, and we will help you choose. Many organizations combine services, for example an assessment followed by protective measures.

CyberWhy is an international provider and the website is in English. How work is organized, including what can be done remotely and what needs to happen on site, is agreed during scoping and depends on the service.

Both depend on the service, the size of the environment and what you need. We do not publish fixed prices or durations because they would not fit most situations. After an initial conversation we set out the scope, the approach and the commercial terms in writing before any work starts.

No provider can honestly promise that. Security is about reducing risk and being prepared. Our work helps you find and fix weaknesses, strengthen defenses and respond better, but it cannot guarantee that an incident will never happen.

Our work involves sensitive information, so confidentiality is part of how we work. The terms are set out in the agreement for your engagement, and you can ask for a non-disclosure agreement before sharing details. Please do not send passwords, logs or evidence through the website form. Describe your situation in general terms and we will agree a secure way to share what is needed.

A penetration test is an authorized, simulated attack. We use the techniques real attackers use against your web applications, APIs and network infrastructure to find weaknesses and show how well your defenses hold up.

Web applications, APIs and network infrastructure. Exactly what is in scope is agreed with you before testing starts.

A vulnerability assessment systematically scans for known weaknesses, outdated software and misconfigurations and ranks what it finds. A penetration test goes further: skilled testers actively attempt to exploit weaknesses the way an attacker would, to show what is really possible. Many organizations use both, and we can help you decide which one fits your goal.

Yes. We only test systems that you are authorized to have tested, and only within the scope and rules of engagement we agree with you. If systems belong to a third party, such as a hosting or cloud provider, their permission may also be needed. We will tell you if that is the case.

Testing is planned so that it fits your business. During scoping we agree what is tested, when it happens and the rules of engagement, including how to handle sensitive or critical systems. Testing involves real attack techniques, so some risk to availability cannot be ruled out completely. We discuss this with you in advance.

A detailed report with findings ranked by risk, a tailored remediation plan and expert recommendations. We then walk through the results with you and agree what happens next.

It can support compliance requirements, incident readiness and the protection of sensitive data. Whether a particular test satisfies a specific requirement depends on that requirement. A test report does not by itself certify compliance.

A systematic scan of your networks, applications and systems for known weaknesses, outdated software and misconfigurations, followed by analysis of what was found.

A detailed analysis and prioritized recommendations, so that remediation starts with the most critical risks. Findings are ranked by priority so that limited time and budget go where they matter most.

Networks, applications and systems. We agree with you which of them are included before scanning begins.

Environments change as software is updated and systems are added, so a single assessment is a snapshot. How often it makes sense to repeat it depends on how quickly your environment changes and on your risk and compliance needs. We can advise you on this.

It supports work toward GDPR, ISO 27001 and NIST requirements by showing where weaknesses exist and what to fix first. It is an input to that work and not a certification.

Scanning is agreed and planned with you beforehand, including when it runs and what is covered. We discuss any systems that need special care during scoping.

Contact us and describe the situation in general terms. Please do not send logs, evidence or credentials through the website form. Where possible, avoid actions that could destroy evidence, such as wiping or reinstalling affected systems, until you have discussed it with the response team. Follow any legal or regulatory obligations that apply to you, including reporting duties.

Containing active threats and removing them, supporting the restoration of normal operations, a forensic investigation of the attack's origin, methods and impact, and identifying the vulnerabilities the attackers used.

An investigation that establishes where an attack came from, which methods were used and what it affected. It also identifies the vulnerabilities the attackers used, so the gap can be closed.

Yes. We work alongside your own team to limit damage and keep the business running.

We support restoring normal operations and turn what was learned into actionable recommendations to strengthen security, so that the same thing does not happen again.

We do not publish response-time promises on this website. Availability and response arrangements are agreed with you directly. Contact us as soon as you suspect an incident.

Customized security strategies, risk assessments, security policy development, compliance support for standards such as ISO 27001 and GDPR, and ongoing guidance to keep security current.

We give guidance toward standards such as ISO 27001, which includes assessing where you stand and developing the policies and processes to put in place. Guidance toward a standard is not certification. Certification is awarded by accredited bodies.

We support work toward GDPR requirements with risk assessments and policy frameworks. This is security guidance. We do not provide legal advice, and for legal questions you should consult a qualified lawyer.

Yes. Consulting is tailored to your organization, whether you are improving what you already have or building something new.

We discuss your business, risks and requirements, assess where you are today, plan a security strategy and the policies behind it, give guidance toward the standards that apply to you, and then provide ongoing advice as your needs change.

Endpoint protection, firewalls, intrusion prevention systems, multi-layered defenses for critical systems, and proactive monitoring with regular updates.

Yes. Protection is tailored to your organization and requirements. We start by understanding what you need to protect and then design layered protection that fits your environment.

Proactive monitoring and regular updates are part of the service, so that protection stays current as threats and your systems change. The details of what we maintain are agreed with you.

It works together with vulnerability assessment and incident response. An assessment shows where to strengthen, protection puts defenses in place, and incident response is there if something still gets through.

Phishing, social engineering and malware, taught through interactive sessions, real-world scenarios and practical exercises.

Yes. Programs are customized to your industry and threat landscape, and adapted to the different groups in your organization instead of a single generic course.

Everyone who uses your systems: office staff, managers, and teams outside the office. Sessions can be adapted to how each group works.

We follow up to reinforce what was learned, so that awareness stays part of daily work. The format of the follow-up is agreed with you.

People who recognize threats and know how to respond.

Please read our Privacy Policy. It explains what we collect through this website, why, how long we keep it, who we share it with and your rights under the UAE Personal Data Protection Law and, where applicable, other data protection laws.

Our Terms & Conditions apply to the use of this website and set out the general terms for our services. The proposal or agreement for your engagement sets out the specific scope, fees and conditions, and takes precedence where it differs.

Yes. Tell us when you contact us and we will arrange it before you share sensitive details.

Thank you. Please write to info@cyberwhy.com with the details, and do not access or change data that is not yours. We review reports in good faith. Please do not run automated scans or attacks against our website without our written permission.

Use the contact page or email info@cyberwhy.com. Our address is Dubai Silicon Valley, Dubai, United Arab Emirates.