Vulnerability Disclosure Programs in Dubai (2026): Why a Free VDP Beats a Bug Bounty

Short answer: a vulnerability disclosure program (VDP) is a published promise that if someone finds a hole in your Dubai website or app, they can tell you safely — it costs nothing but a policy page, an inbox and a security.txt file. A bug bounty is the paid version, and in 2026 it is the wrong first step for almost every UAE SME: platform fees alone run AED 73,000 to AED 275,000 a year before a single reward, and the big programs are closing under a flood of AI-generated junk. Publish the channel first. Pay for reports later, if ever.

Three UAE numbers that set the stakes

• Around 600,000 cyberattacks are blocked in the UAE every single day — roughly 25,000 an hour, or 416 a second — according to Dr Mohamed Al Kuwaiti, head of the UAE Cyber Security Council. In one day in September 2026 the Council reported thwarting more than 640,000, including an attempt to destroy critical private-sector infrastructure data.
• Under Federal Decree-Law No. 34 of 2021, accessing a website or information system without permission carries detention plus a fine of AED 100,000 to AED 300,000, and where the target is government data or confidential financial, trade or economic information, temporary imprisonment plus AED 250,000 to AED 1,500,000. There is no stated exception for a security researcher acting in good faith.
• The UAE’s National Cyber Security Strategy 2025–2031 has ended the era of voluntary guidance. As of 2026, NESA / UAE IAS v2 (now administered by the Signals Intelligence Agency) and DESC ISR v3 set mandatory expectations — and ISR applies to private vendors supplying Dubai government entities, where non-compliance means removal from procurement lists and contract termination.

Put those three facts side by side and you get the problem most Dubai businesses have never thought about. Your site is being probed constantly. Somebody, eventually, finds something real. And UAE law gives that person every incentive to say nothing — because the act of looking is, on its face, a criminal offence with a six-figure fine attached. The only thing that changes the maths is a written invitation from you.

Most Dubai businesses get this exactly backwards. They budget AED 25,000 for a penetration test once a year and leave no way at all for the other 364 days of findings to reach them.

Why “just launch a bug bounty” is bad advice in 2026

Bug bounties had a brutal year. The numbers from HackerOne’s tenth-edition Security Research Report, covering July 2025 to June 2026, explain why: USD 89.1 million (about AED 327 million) paid out across 92,194 valid reports, but open valid reports up 131% since 2024 and the critical backlog up 123% over two years. 70% of security leaders said validated findings now enter their backlog faster than their teams can remediate them. AI-related vulnerability reports rose 222% in two years — system prompt leakage alone up 557%.

Then the programs started shutting. The clearest case is curl, one of the most widely deployed pieces of software on earth. Maintainer Daniel Stenberg announced on 26 January 2026 that the curl bug bounty would stop on 31 January 2026, after a decade in which it confirmed 87 vulnerabilities and paid out over USD 100,000 (about AED 367,000). The reason was arithmetic, not principle: the share of submissions that turned out to be real vulnerabilities fell from north of 15% to below 5% — fewer than one in twenty — as AI-assisted reports arrived in volume, plausible-looking and wrong.

Google followed. On 1 October 2026 it paused new product vulnerability submissions to its Open Source Software Vulnerability Rewards Program, citing a significant rise in automated reports of which the vast majority failed validation, with an update promised in Q1 2027 (supply-chain reports stayed in scope). GitHub restructured its program from 27 July 2026 around an invite-only VIP tier and a four-submission cap for new researchers. Industry reporting put overall submission volume up 76% year on year with only about a quarter flagging real flaws; one vendor, Screenly, said just 39 of 331 reports it received were genuine.

Read that as a warning about rewards, not about disclosure. The thing that broke was the paid funnel, where a cheap AI-written report has positive expected value for the sender. A VDP has no reward and therefore no spam incentive — and it is the part the regulators actually ask for.

What the UAE and the EU now expect you to have

The UAE already runs both halves of this at national level. The Cyber Security Council launched a National Bug Bounty Programme, piloted with Etisalat and du in coordination with the TDRA, and publishes a National Vulnerability Disclosure Policy that sets out ethical-testing rules, tester registration, reporting, validation and closure. Note one detail that surprises people: the national policy rewards testers through a non-monetary recognition program, not cash. The State’s own model is disclosure-first.

If you export software, the harder deadline is European. Under the EU Cyber Resilience Act (Regulation (EU) 2024/2847), a coordinated vulnerability disclosure policy is a mandatory manufacturer obligation for any “product with digital elements” placed on the EU market — and that includes non-EU manufacturers selling in. Reporting duties went live on 11 September 2026: for an actively exploited vulnerability, a 24-hour early warning, 72-hour notification, and a final report within 14 days of a fix being available; for a severe incident, 24 hours, 72 hours, then one month. Manufacturers must support vulnerability handling for at least five years. Full application lands 11 December 2027, and Article 64 fines reach EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaches of manufacturer and reporting obligations (with EUR 10 million / 2% and EUR 5 million / 1% tiers below).

You cannot hit a 72-hour clock if the first you hear of a bug is a LinkedIn post. That is the real function of a VDP: it is the intake valve for every compliance timer you are now subject to.

The four options, and what they actually cost in Dubai

These are not competing products. They are rungs, and nearly everyone should start on the first one.

Option	Dubai cost (2026)	What it finds	Right for
Self-hosted VDP policy page + security.txt + triage inbox	AED 0 platform cost ~AED 8,000–20,000 to set up properly, plus internal triage time	Whatever the world finds on your live systems, year-round	Every Dubai business with a public website or app
Penetration test / VAPT	Web app AED 15,000–30,000; single app with one role AED 25,000–55,000; web + API + cloud AED 75,000–180,000; full-stack enterprise AED 250,000–600,000 (SMB entry from ~AED 9,000)	A deep, scoped, point-in-time snapshot with a report you can hand an auditor	Compliance evidence (NESA IAS control T3.2 expects tracked assessments), pre-launch, post-major-release
Private bug bounty invited researchers	Platform USD 50,000–100,000/yr (AED 184,000–367,000) plus a typical USD 50,000–150,000 (AED 184,000–551,000) reward pool	Creative, incentivised attacks on a mature product	Funded product companies with a dedicated security team
Public bug bounty / managed	Managed platform + triage USD 100,000–250,000/yr (AED 367,000–918,000); whole programs span USD 30,000 to 500,000+ (AED 110,000–1.84m)	Everything — including the AI-slop volume that closed curl’s program	Large enterprises that can staff full-time triage

Note the gap. A HackerOne VDP — reports in, no bounties — still carries an annual platform fee of roughly USD 20,000 to 75,000, or AED 73,000 to AED 275,000. Hosting the same thing yourself on your own domain costs a page, a mailbox and a documented SLA. For a Dubai SME, that difference is the entire decision.

How to stand up a VDP in one week

1. Write the safe harbour clause first

This is the clause that makes the whole thing work in the UAE. State plainly that you authorise good-faith security research against the listed scope, that you will not pursue civil or criminal action for activity that follows the policy, and that you will say so to the authorities if asked. Without written authorisation, a researcher poking at your login page is exposed to AED 100,000–300,000 under Article 2. Your policy is the only thing standing between a responsible report and silence.

2. Define scope and out-of-scope narrowly

List the exact domains, apps and API hosts in scope. Explicitly exclude denial-of-service, physical testing, social engineering of your staff, automated scanning that degrades service, and anything touching real customer personal data — which keeps you on the right side of the UAE PDPL as well. Say what you do not want reported: missing security headers, self-XSS, rate-limit noise, and third-party SaaS you do not control.

3. Publish /.well-known/security.txt

RFC 9116 defines a machine-readable file served over HTTPS as plain-text UTF-8 at /.well-known/security.txt. Contact and Expires are mandatory, the expiry should sit less than a year out, and the RFC warns that a stale file is worse than no file at all — so put the renewal in a calendar, not in someone’s head. Add Policy, Preferred-Languages: en, ar, and Acknowledgments pointing at a hall-of-fame page.

4. Commit to timelines you can keep

Acknowledge within 3 business days, triage and assign severity within 10, and give a remediation target by severity. For calibration: HackerOne reports average critical-finding validation at 30 hours, and average resolution across all severities improved 54% in two years, from 135 days to 62. If you are exporting to the EU, your internal clock has to be tighter than your public one — the CRA’s 24-hour early warning for an actively exploited flaw starts the moment you become aware.

5. Run it against the standards, then reuse the evidence

Map your process to ISO/IEC 29147:2018 (how you receive and publish disclosures) and ISO/IEC 30111:2019 (how you handle them internally). Those two documents underpin the European certification guidance and give an auditor something recognisable. The same artefacts — policy, intake log, severity matrix, remediation timestamps — slot straight into DESC ISR v3 vulnerability-management and secure-development evidence, and into the ISO 27001 file you probably already maintain. One week of work, three compliance boxes.

6. Add a human filter before you ever add money

Given a 2026 baseline where roughly three-quarters of submissions are noise, require a reproducible proof-of-concept, a stated impact and the exact affected endpoint before anything is escalated. Reject on template, not on argument. This single rule is why a VDP survives the AI-report era and an open bounty often does not.

What this is worth in AED

Run the cost-of-inaction honestly. IBM’s 2026 figures put the average cost of a data breach in the Middle East at USD 8.0 million, roughly AED 29.4 million. Against that, a VDP is the cheapest control on the entire security budget: it has no licence, no per-seat fee, and no annual renewal, and it converts strangers who already found your bug from a reputational risk into an unpaid early-warning system. The expensive layer — a scoped penetration test or VAPT engagement at AED 15,000–55,000 for a typical Dubai web application — then gets pointed at the things nobody reported, instead of rediscovering the obvious.

There is a commercial upside too. If you sell to Dubai government entities, or into regulated UAE sectors, or into the EU after 11 September 2026, a published disclosure policy is now a procurement answer rather than a nice-to-have. The question on the security questionnaire is no longer “do you pentest?” — it is “where do I send a vulnerability report, and how fast do you respond?”

How we run it at Aquarius: a fixed-price week that drafts the policy with UAE safe-harbour wording reviewed against Decree-Law 34/2021, ships a validated security.txt, wires the intake into whatever you already use for tickets, and leaves you an evidence pack formatted for ISR and ISO reviewers. No platform subscription, no lock-in, and the documents are yours. If software you ship to customers is in scope, pair this with our notes on software supply chain security and SBOMs; if you are sizing the financial downside, cyber insurance in Dubai is the companion read. Build ranges live on our pricing page and the engineering side on services.

FAQ

What is the difference between a VDP and a bug bounty?

A VDP is a published channel and legal promise: here is where to report a vulnerability, here is what we allow, here is how fast we respond, and we will not take action against good-faith research. A bug bounty adds cash rewards and usually a commercial platform. A VDP is infrastructure; a bounty is a procurement decision. The UAE Cyber Security Council runs both nationally, and its own tester rewards are non-monetary recognition rather than cash.

Is a vulnerability disclosure program legally required in the UAE?

There is no single UAE statute that says “publish a VDP.” But as of 2026, NESA / UAE IAS v2 and DESC ISR v3 impose mandatory vulnerability-management expectations — including tracked vulnerability assessments under control T3.2 — and ISR reaches private vendors serving Dubai government entities, where failure means removal from procurement lists. If you place software on the EU market, a coordinated vulnerability disclosure policy is explicitly mandatory under the Cyber Resilience Act, with reporting duties live since 11 September 2026.

Can a security researcher be prosecuted in the UAE for reporting a bug?

Federal Decree-Law No. 34 of 2021 criminalises unauthorised access to a website or information system, with fines of AED 100,000–300,000 and higher penalties where government or confidential financial data is involved, and the published summaries of the law contain no good-faith research exception. That is precisely why your policy’s written authorisation and safe-harbour clause matter: it is the document that makes the testing authorised in the first place. For testing against national critical systems, the Cyber Security Council’s National Vulnerability Disclosure Policy sets out registration and ethical-testing requirements.

How much does a bug bounty program cost in Dubai in 2026?

Platform fees alone: roughly USD 20,000–75,000 a year (AED 73,000–275,000) for a VDP on a commercial platform, USD 50,000–100,000 (AED 184,000–367,000) for a private bug bounty plus a USD 50,000–150,000 reward pool, and USD 100,000–250,000 (AED 367,000–918,000) for a fully managed program with triage. Total program spend across the market runs from USD 30,000 to over USD 500,000 a year. A self-hosted VDP has no platform fee at all.

Does a VDP replace penetration testing?

No, and anyone who tells you otherwise is selling something. A pentest is scoped, credentialed, time-boxed and produces the signed report auditors and insurers ask for; in Dubai that is AED 15,000–30,000 for a web application, AED 25,000–55,000 for a single app with one user role, and AED 75,000–180,000 once APIs and cloud IAM are included. A VDP covers the other eleven months. Run both — and start with the free one.

Will a VDP flood us with AI-generated junk reports?

Far less than a bounty will, because the spam incentive is financial. The 2026 collapses — curl ending its bounty on 31 January after its valid-report rate fell below 5%, Google pausing OSS VRP submissions on 1 October, GitHub capping new researchers at four submissions from 27 July — all hit reward programs. An unpaid, narrowly scoped VDP that demands a reproducible proof-of-concept before escalation stays manageable for a small team.

If your Dubai website or app has no published way to report a security hole, that is a one-week fix and the cheapest line item in your 2026 security plan. Send us your domain and we will tell you, free, what a researcher can already see and what your disclosure page should say.