Security that stands up
to the real world.

SandBox Security is a cybersecurity and compliance firm that helps regulated organisations achieve certification, test their defences against real attacks and secure their AI systems. Our services cover PCI DSS, ISO 27001, data privacy, VAPT, red teaming, AI red teaming and security training, delivered by practising assessors and testers.

SandBox Security is headquartered in Dubai, UAE, with an office in Bengaluru, India. We deliver cybersecurity and compliance engagements across the UAE, Saudi Arabia and the wider GCC, India and Africa, both on-site and remotely.

We work mainly with regulated industries: banks, payment institutions, fintechs, healthcare providers, cloud and data-centre operators, retail and e-commerce, telecoms and government entities. These organisations face regulatory penalties, not just reputational damage, when security or compliance fails.

PCI DSS (Payment Card Industry Data Security Standard) is a global security standard for any organisation that stores, processes or transmits payment card data. Compliance means meeting its 12 requirements, from network security and access control to logging and regular testing, and validating that through an annual assessment. The current version is PCI DSS v4.0.1.

Any business that accepts, processes, stores or transmits card payments needs PCI DSS compliance, including merchants, banks, payment gateways, payment service providers and fintechs. Service providers that can affect the security of card data, such as hosting or managed service providers, are also in scope.

A PCI Qualified Security Assessor (QSA) is an assessor certified by the PCI Security Standards Council to validate an organisation's PCI DSS compliance. The QSA tests controls against the standard, documents the results in a Report on Compliance (ROC) and signs the Attestation of Compliance (AOC) that banks and card brands accept.

Yes, within limits. A QSA company can deliver readiness and gap assessments and then perform the formal assessment, but PCI SSC independence rules prevent a QSA from assessing controls it designed or implemented for you. We scope every engagement so the final assessment stays independent and stands up to scrutiny.

A PCI DSS assessment typically takes 4 to 12 weeks, depending on the size of your cardholder data environment, the number of locations and how ready your evidence is. Organisations starting from scratch usually need a gap assessment and remediation phase of several months first.

No. PCI DSS compliance shows your controls met the standard at the time of assessment; it does not guarantee you won't be breached. Controls drift between assessments and attackers adapt. That is why we pair compliance with continuous testing and help clients keep controls effective all year, not just at audit time.