The verdict in three sentences
CISOs and CIOs in Dubai increasingly ask AI assistants like ChatGPT for a shortlist of penetration testing, SOC and incident response providers before they open a single search results page. A cybersecurity firm is named in those answers when its public information is consistent, factual and confirmed by third parties, and it is left out when its site is a wall of slogans and its certifications are vague. The work is an emerging market, roughly USD 3,000 to 10,000 for a diagnostic and USD 2,500 to 8,000 a month for ongoing work (2026 ballpark), and it is measured with a dated record of answers to the same questions.
What security buyers in Dubai now ask AI assistants
The questions are long, specific and often framed around a deadline: an audit, a board meeting, a regulator's request or an incident in progress. They mix geography (Dubai, DIFC, the free zones, the wider UAE), certifications and language. The table below gives realistic examples of what a buyer might type, and what the assistant has to find somewhere in public to name your firm.
| Question a buyer might ask | Typical asker | What the answer needs to find |
|---|---|---|
| "Which firms in Dubai offer CREST accredited penetration testing for a fintech?" | Head of security, fintech in DIFC | A clear statement of which CREST accreditations the firm actually holds, and a fintech pentest page |
| "Who provides a 24/7 managed SOC in the UAE with Arabic speaking analysts?" | CIO, family conglomerate | SOC service page, hours, analyst languages, location of the operations centre |
| "Incident response retainer in Dubai: which providers, and what does it usually cost?" | CFO and CISO together | Retainer page with response time commitments and the scope of the hotline |
| "Which consultants help a DIFC company align with the DIFC data protection law?" | General counsel, DPO | Compliance service page naming the regime, team credentials, no promise of legal outcome |
| "How should a 300 person company in Dubai prepare for ISO 27001 certification, and who can help?" | IT director | Guide page, timeline, whether the firm itself is ISO 27001 certified and for what scope |
| "Is there a cybersecurity firm in Dubai that supports EU NIS2 or DORA obligations for a European parent group?" | Group CISO based in Europe | Pages on EU frameworks written in plain terms, team members with relevant experience |
Buyers ask for evidence, not adjectives, and many questions cross borders: Dubai entities often report to a group in London, Paris or Riyadh, so English and Arabic pages must say the same thing.
Why some firms are named and others are not
AI assistants assemble answers from what is publicly available and consistent across sources. A firm with a precise service page, matching directory listings and a few independent mentions gives them something solid to repeat.
| Signal | What it looks like for a cyber firm | Common gap in Dubai |
|---|---|---|
| Consistent facts | Same legal name, address, licence type and services on the site, LinkedIn and directories | Old trade name in a free zone register, new brand on the site |
| Certifications as actually held | CREST, ISO 27001 scope, individual credentials of the team, each stated precisely | "Certified experts" with no detail, or a logo for an accreditation that has lapsed |
| One page per service | Pentest, SOC, incident response, GRC, cloud security, each with scope and deliverables | One "Services" page listing twelve buzzwords |
| Third party mentions | Conference talks, vendor partner listings, industry association membership, press interviews | No mention outside the firm's own channels |
| Structured data | Organization and Service markup that matches the visible page | Missing, or copied from a template with the wrong address |
| Arabic and English parity | The Arabic version states the same facts as the English one | Arabic pages that are partial or machine translated |
The niche adds constraints. A security firm cannot name clients or describe incidents without written consent, and claiming an accreditation it does not hold is both a reputational and a legal risk. Pages that describe how the firm handles client data should match its real practice, because the UAE has a federal personal data protection law (Federal Decree-Law 45 of 2021) while DIFC and ADGM run their own data protection regimes. This is not legal advice: the firm's counsel should review any page that touches regulatory claims.
What the work covers and what it costs in 2026
In broad terms, the work covers an audit of how AI assistants describe the firm today, the correction of inconsistent facts across the site and external profiles, clearer factual pages for each service, the earning of genuine third party mentions, structured data, an Arabic version where the market requires it, and regular measurement. It is an emerging service: prices vary widely and few providers publish them. The ranges below come from typical agency quotes and public rate pages, as a 2026 ballpark.
| Item | 2026 ballpark (USD) | Note |
|---|---|---|
| One-off diagnostic (questions, answers, gaps) | 3,000 to 10,000 | Depends on the number of services and languages |
| Monthly retainer, specialist agency in Dubai | 2,500 to 8,000 | Usually includes content and measurement |
| Freelance consultant, monthly | 1,000 to 3,000 | Narrower scope, rarely covers Arabic |
| Arabic adaptation of a service page | 150 to 400 per page | Native review recommended for technical terms |
| Industry mentions and digital PR, monthly | 1,500 to 6,000 | Conference and media outreach, never paid fake reviews |
| Measurement only, monthly | 500 to 1,500 | Dated tracking of a fixed question set |
At Kolonell this work is on quote, scoped after a diagnostic of your services, markets and languages.
How it is measured
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Measurement starts with a fixed list of questions, typically 25 to 50, asked at regular dates and recorded with the full answer. Because answers vary from one run to the next, each question is asked several times. Three indicators matter: the share of answers that mention the firm, the accuracy of what is said (services, accreditations, location, hotline), and the sources the assistant appears to rely on. No serious provider can promise that an AI assistant will recommend a firm, and anyone who does should be questioned closely. What can be shown is a dated, comparable record over six to twelve months.
Mini case study
Illustrative example: "Qasr Shield Security" is a fictional 45 person firm in Dubai offering pentest, managed SOC and incident response. Its managing partner wants to know how it appears when CISOs ask AI assistants for providers.
- Baseline: 30 questions asked 3 times each, so 90 answers. The firm is named in 6 of them, a share of 6.7%.
- Accuracy: in 4 of those 6 answers, the description is outdated (an old service name and a wrong ISO 27001 scope).
- Budget hypothesis: a diagnostic at USD 6,000 plus six months of work at USD 4,000, so USD 30,000.
- Business test: a single incident response retainer at USD 48,000 a year would cover that budget 1.6 times.
FAQ
Can a cybersecurity firm pay to be recommended by ChatGPT?
No. There is no paid placement inside the answers of AI assistants like ChatGPT, and no serious provider promises a recommendation. Budgets of USD 2,500 to 8,000 a month buy work on public information and measurement, not a slot.
How long before changes show up in answers?
Corrections to facts and new service pages can appear within 2 to 4 months, while third party mentions take longer to build. A fair review point is after 6 months of dated records.
Do we need Arabic pages for AI visibility in Dubai?
If part of your buyers work in Arabic, yes, and the Arabic version must state the same facts as the English one. Adapting a technical service page typically costs USD 150 to 400 in 2026, with native review.
Does this replace SEO?
No, the two overlap. Clear service pages, structured data and external mentions help both, and many firms run them under one budget with separate measurement.
Find out how AI assistants describe your firm. We record the answers to your buyers' real questions, in English and Arabic, and show you what is missing or wrong. Request a diagnostic quote: reply within 48 hours.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
