If the foundations aren't solid, the house will always fall down.

Security works the same way. Most businesses have some security. Very few are confident it would hold up when it actually matters — under pressure, during an audit, or when something goes wrong at 2am.

We help businesses across the Middle East get the basics right and build safely from there. Independent, vendor neutral, and focused on your business — not on selling you something.

Sound familiar?

These are the conversations we have most often, and if any of them land, we should talk.

This happens to almost every growing business at some point. One enterprise client, one serious questionnaire, and suddenly security can't be pushed back any further. We handle questionnaires on your behalf — accurately and consistently — so the answer that goes back is something you can stand behind We can help with this →

Most businesses find out their backups don't work during an incident. By then it's too late. We test them before that happens and make sure recovery is something you can actually rely on — not just something that exists on paper. Let's check →

ISO 27001 feels enormous until someone breaks it down into what actually needs to happen. We've done it enough times to make it manageable. We stay involved until certification is achieved — not just until the gap assessment is done and the report is filed. We've done this before →

A breach isn't just an IT problem. It's a legal problem, a regulatory problem, and a reputational one. GDPR, UAE data protection law, contractual liability with your clients — the consequences are real. We put the controls in place that reduce both the likelihood and the damage before something happens. Let's reduce your exposure →

Call us. If something feels off — unusual system behaviour, suspicious emails, accounts acting strangely — we'll can support to tell you what's happening and what to do about it. This is exactly what we're here for. Don't wait until you're certain something is wrong. Get in touch now →

Board level cyber reporting doesn't need to be technical — it needs to be honest and proportionate. We translate your security posture into plain language your board can act on. Clear, defensible, and something you can actually stand behind when a difficult question gets asked. We can help with this →

Most security work ends when the report does. Ours doesn't.

The problem usually isn't intent. It's foundations. Email isn't properly secured. Backups haven't been tested. Policies exist but nobody's read them. AI tools are being adopted faster than anyone's thought through the risk. When the basics aren't right, everything built on top is fragile — no matter how sophisticated it looks. We fix that first. Then we build from there. And we stay involved until it's actually working — not just until the project closes.

We start with what matters most

Email security, backups, device protection, basic policies. Not because they're easy — because they're what your business actually depends on day to day. Get these right and you've solved 80% of the risk most businesses face.

We don't sell you what vendors want us to sell

No partnerships. No commissions. No preferred tools. If something won't materially improve your security we won't recommend it — even if a vendor would pay us well to do so.

We stay until it's working

Most security firms hand you a report and move on. We stay involved until the work holds up — under pressure, through change, and when something goes wrong. Our job isn't done when the engagement ends. It's done when security works.

Managed Security Services

Most businesses have some security set up. Very few know for certain it's actually working. Email gets misconfigured. Patches slip. Someone leaves and their account stays active for months. We cover your foundations every month — and we stay involved so the basics don't quietly fall apart while you're focused on running the business. What's covered: Email security · SPF/DKIM/DMARC · Anti-phishing · Phishing simulations · Device protection · CIS hardening · MFA and Conditional Access · Vulnerability management · Patch management · EDR management · DNS filtering · Dark web monitoring · Threat intelligence · IT support · DDQ support · Asset and risk registers · BC/DR basics · Cyber insurance advisory

Governance & compliance

A client sends you a security questionnaire you don't know how to answer. Your biggest contract requires ISO 27001. Your board is asking about data protection and nobody's sure what to tell them. These situations don't go away — they come back harder each time. We sort out your compliance properly so when someone asks a hard question, you have a real answer. What's covered: ISO 27001 support · Cyber Essentials · UAE IA alignment · DESC ISR · InfoSec policy creation and review · Risk register management and board level risk reporting · Asset register review · TPRM supplier reviews - we help you to understand your supply chain risks · DDQ support — we respond on your behalf · Regulatory notification support

People & awareness

Most security incidents involve a human somewhere in the chain. A clicked link, a weak password, a panicked decision at 2am. You can have the best technical controls in the world and still get breached because someone opened the wrong email. We help fix the human side of security — without making your team feel blamed for it. What's covered: Phishing simulations — GCC-relevant, realistic scenarios · Security awareness training tailored to the UAE threat landscape · Tabletop exercises — leadership and operational teams · Incident simulations — test how your business actually responds under pressure · Board level cyber briefings · Human risk reporting · Secure behaviour programmes

Technical projects

Sometimes you don't need a managed service — you need a specific problem solved properly. A network that's grown without a plan. An OT environment nobody's properly secured. A security programme that's been handed off between people and lost its shape. We come in, scope it clearly and deliver it. What's covered: OT/ICS security architecture — IEC 62443, Purdue model · Network segmentation and Zero Trust · SD-WAN and SASE design · Penetration testing · Security programmes · Failing programme recovery · Cloud security architecture · PKI and identity infrastructure · Incident response — triage, containment, recovery · Attack surface management · Post-incident review and lessons learned

Private & Executive

The higher your profile, the more people are paying attention to you online — and not always for good reasons. A compromised personal device, an exposed email account, a family member targeted because of who you are. These aren't hypothetical risks for founders, executives, and high profile individuals. We handle the personal side of digital security quietly, proportionately, and without making it a bigger deal than it needs to be. What's covered: Personal device security assessment · Home network review · Executive digital footprint assessment · Social media exposure review · Dark web monitoring — personal · Family digital safety · Secure communications guidance · Discreet incident support

The Amantris Pledge

Every year we set aside 25 places for freelancers and micro businesses in the UAE. Three months of real, hands-on security support — the kind that actually makes a difference day to day. We cover your email security, get your devices properly protected, write you a policy that reflects how your business actually works, and give you a roadmap you can build from. Our way of giving something back. What you get: Email security — SPF/DKIM/DMARC configured and tested · Personal and work device security assessment · MFA set up across your accounts · One tailored InfoSec policy — written for your business, not copied from a template · Security awareness guide · Basic asset register · Security roadmap — a clear picture of what to do next · One follow-up review call

Operation Safe Harbour 2026

The UAE has given us a home and a community we're proud to be part of. Safe Harbour is our way of giving something back. In 2026 we're supporting 100 UAE businesses with six months of free hands-on security support — because we want the businesses building this country's future to be protected while they do it. This isn't a taster session or a sales funnel. It's six months of real work — the same standard we deliver to paying clients. When it ends, you keep everything we've built. There's no pressure to continue and no obligation to become a client. What you get: CIS hardening across your devices and cloud environment · Microsoft Defender and email protection baseline · SPF/DKIM/DMARC configured and monitored · Phishing simulation — so your team knows what to look for · Tailored InfoSec policy — aligned to ISO 27001 and UAE IA · Security roadmap · Risk register — created and maintained · Asset register — created and maintained · Six months of vulnerability management · Automated patching via Intune · External exposure assessment — passive, nothing touches your systems · Monthly security review call

Overline

We work with businesses operating in the Middle East that need security to actually work

Security looks different depending on where you sit. A recruitment firm in Dubai Marina has different pressures to a multinational managing operations across the Gulf. A healthcare provider navigating UAE data regulations has different needs to a family office worried about personal exposure.

We work across all of it. Our team has spent years in some of the UK's most demanding regulated environments — which means when clients with high expectations come to us, we already understand the standard they're used to. We're not the right fit for every business and we'd rather be honest about that than take on work we can't do properly. But if security genuinely matters to someone at the top of your organisation, we're probably worth a conversation.

Multinationals & international businesses

If your headquarters is in London, New York, or Frankfurt and you're running operations in the Gulf, you already have a security standard you're expected to meet. Finding a partner here who understands that standard without needing to be brought up to speed is harder than it should be. We've worked in the same environments your security teams came from — so the conversation starts in the right place.

Professional services

Law firms, consultancies, and accountancies in the UAE carry more risk than most people give them credit for. Sensitive client data, growing assurance requirements from your own clients, and a reputation that takes years to build and seconds to damage. Security needs to be credible and proportionate here — not a burden that slows the business down. That's a balance we understand.

Real estate

Real estate businesses in the UAE handle significant volumes of personal and financial data — passport copies, bank details, transaction records. That data is valuable, it's regulated, and institutional partners and investors are increasingly asking serious questions about how it's protected. Most real estate businesses don't prioritise security until something forces the issue. We'd rather help you get ahead of it.

Recruitment & staffing

Recruitment firms hold some of the most sensitive personal data of any business — CVs, salary information, passport copies, financial details. That data is valuable to attackers and increasingly scrutinised by regulators. We help you protect your candidates, your clients, and your reputation.

Healthcare

Patient data, operational pressure, UAE health authority requirements — healthcare is one of the highest-stakes environments to get security wrong in. The consequences are immediate and they affect real people. We work proportionately here, focused on what actually matters in your environment. Not every framework designed for a hospital group makes sense for a clinic with thirty staff. We know the difference.

Industrial & OT

If your business runs operational technology — factory floors, industrial controls, multi-site infrastructure — standard IT security approaches don't translate directly. The risks are different, the architecture is different, and getting it wrong has consequences that go beyond data. We've delivered IEC 62443-compliant security programmes across 68 sites in 15 countries. It's one of the things we know well.