Rapid7 is formally entering the UAE with a new local entity, a local instance of its platform, and Dubai Electronic Security Center (DESC) certification. The company has opened a Dubai office and will be at GITEX Global 2025, with CEO Corey Thomas speaking on 15 October. It’s a concrete signal that customers can keep data inside national borders while using Rapid7’s exposure management tech.
What’s new, in short
- UAE entity formed; local cloud instance live.
- DESC certification achieved for working with government and regulated sectors.
- Dubai office opened to support customers and partners.
- Exposure Command to lead the product push; recent analyst nods cited.
- Corey Thomas to present at GITEX on 15 October; Rapid7 exhibiting.
A local entity with a local cloud
Rapid7 isn’t just selling into the UAE; it’s standing up infrastructure and people here.
- New UAE legal entity formed.
- Local instance of Rapid7’s platform for in-country processing.
- Office opened in Dubai to support government and enterprise customers.
A local entity plus a local cloud instance matters for procurement and latency, but mostly for sovereignty. Security teams can operate within UAE borders without shipping logs or telemetry abroad. With an on-the-ground team, Rapid7 can also line up with UAE working weeks, procurement rules, and Arabic/English support needs.
DESC certification: the big compliance tick
- Rapid7 has achieved DESC certification.
- Certification signals alignment with Dubai’s cybersecurity standards.
- Eases adoption for government and regulated industries.
DESC frameworks help agencies and critical-infrastructure operators assess risk and mandate controls. Rapid7 clearing this bar, and doing it alongside a local instance, reduces legal and audit friction for programmes touching government data or national infrastructure. It’s the practical difference between a “maybe later” and a purchase order.
“Establishing a UAE entity and data sovereignty demonstrates Rapid7’s commitment to the region’s cyber vision,” said CEO Corey Thomas, pointing to dedicated cloud infrastructure for the UAE and Gulf.
Exposure Command is the spearhead
The first product push is about seeing — and shrinking — the attack surface.
- Exposure Command: attack-surface visibility across vulns, apps, and cloud.
- Emphasis on visibility, prioritisation, remediation, and response.
- Recent analyst recognition: IDC MarketScape Leader (Exposure Management 2025) and Forrester Wave Strong Performer (UVM 2025), per Rapid7.
Expect a single view of assets, issues, and risk, with workflows to fix the worst first. That’s handy for boards asking “are we exposed to X?” and regulators asking “prove you patched Y.” The managed-services angle and automation should help lean teams keep up with cloud sprawl without hiring ten more engineers.
Why UAE timing makes sense
The market is hot, and sovereignty is now table stakes.
- UAE cybersecurity market pegged at US$4.51bn by end-2025 (as cited in the release).
- Data sovereignty is now a strategic and regulatory expectation.
- National programmes prioritise cyber resilience across sectors.
With more public-sector digital services, more AI pilots, and more hybrid work, the attack surface is expanding fast. Vendors that can meet local rules and stay in-country will get the meeting. Those that can’t will wait outside. Rapid7 is choosing the former.
For more on UAE-specific security shifts, see our coverage of banks moving away from SMS OTPs, which shows how quickly local controls can change and why platform agility matters. (Read: UAE banks are phasing out OTPs on Tbreak.)
See Rapid7 at GITEX 2025
The company is going public with the message on the region’s biggest stage.
- Corey Thomas to speak on 15 October at the Cybersecurity Theatre, DWTC.
- Rapid7 exhibiting at Stand H23-11, Hall 23.
If you’re building or auditing a security programme, this is the moment to quiz the team on deployment models, tenancy isolation, and how data stays inside the UAE. And yes, ask them to whiteboard their Exposure Command risk scoring before you sign.
Is Rapid7 operating a local cloud in the UAE?
Yes. The company says it has a local instance of its platform running in the UAE to support data sovereignty and compliance needs.
What certifications has Rapid7 achieved for Dubai?
Rapid7 has obtained Dubai Electronic Security Center (DESC) certification, enabling work with government and regulated sectors aligned to Dubai’s cybersecurity standards.
Which Rapid7 product is launching first in the UAE?
Exposure Command, positioned for attack-surface visibility and unified exposure management across vulnerabilities, applications, and cloud.
