Frequently Asked Questions

SandBox Security is a cybersecurity and compliance firm that helps regulated organisations achieve certification, test their defences against real attacks and secure their AI systems. Our services cover PCI DSS, ISO 27001, data privacy, VAPT, red teaming, AI red teaming and security training, delivered by practising assessors and testers.

SandBox Security is headquartered in Dubai, UAE, with an office in Bengaluru, India. We deliver cybersecurity and compliance engagements across the UAE, Saudi Arabia and the wider GCC, India and Africa, both on-site and remotely.

We work mainly with regulated industries: banks, payment institutions, fintechs, healthcare providers, cloud and data-centre operators, retail and e-commerce, telecoms and government entities. These organisations face regulatory penalties, not just reputational damage, when security or compliance fails.

PCI DSS (Payment Card Industry Data Security Standard) is a global security standard for any organisation that stores, processes or transmits payment card data. Compliance means meeting its 12 requirements, from network security and access control to logging and regular testing, and validating that through an annual assessment. The current version is PCI DSS v4.0.1.

Any business that accepts, processes, stores or transmits card payments needs PCI DSS compliance, including merchants, banks, payment gateways, payment service providers and fintechs. Service providers that can affect the security of card data, such as hosting or managed service providers, are also in scope.

A PCI Qualified Security Assessor (QSA) is an assessor certified by the PCI Security Standards Council to validate an organisation's PCI DSS compliance. The QSA tests controls against the standard, documents the results in a Report on Compliance (ROC) and signs the Attestation of Compliance (AOC) that banks and card brands accept.

Yes, within limits. A QSA company can deliver readiness and gap assessments and then perform the formal assessment, but PCI SSC independence rules prevent a QSA from assessing controls it designed or implemented for you. We scope every engagement so the final assessment stays independent and stands up to scrutiny.

A PCI DSS assessment typically takes 4 to 12 weeks, depending on the size of your cardholder data environment, the number of locations and how ready your evidence is. Organisations starting from scratch usually need a gap assessment and remediation phase of several months first.

No. PCI DSS compliance shows your controls met the standard at the time of assessment; it does not guarantee you won't be breached. Controls drift between assessments and attackers adapt. That is why we pair compliance with continuous testing and help clients keep controls effective all year, not just at audit time.

ISO 27001 certification usually takes 3 to 6 months for an organisation with some documented controls, and 6 to 12 months for one starting from scratch. The timeline covers building the information security management system (ISMS), running it long enough to produce evidence, an internal audit and the two-stage certification audit.

We support the UAE Information Assurance Standard (formerly NESA), Dubai DESC ISR, Abu Dhabi ADHICS for healthcare, Central Bank of the UAE (CBUAE) requirements for financial institutions and SAMA requirements in Saudi Arabia. We also map these to ISO 27001 and NIST so one control set satisfies several regulators.

The Digital Personal Data Protection (DPDP) Act, 2023 is India's data protection law. It applies to any organisation processing digital personal data in India, and to organisations abroad that offer goods or services to people in India. The DPDP Rules were notified in November 2025, with most obligations taking effect 18 months later, around May 2027. Penalties reach up to INR 250 crore per instance.

We run privacy gap assessments against GDPR, India's DPDP Act and regional data protection laws, then do the operational work: data inventories, data flow mapping, data classification, data localisation analysis and consent and notice reviews. After the initial programme, we provide ongoing compliance sustenance.

Yes. ISO 27001, PCI DSS, SOC 2, NIST CSF and most regional frameworks share a large share of their controls. We build a unified control framework so you collect evidence once and reuse it across audits, which reduces cost and audit fatigue.

VAPT (Vulnerability Assessment and Penetration Testing) combines automated and manual testing to find security weaknesses and then safely exploit them to prove their real impact. It covers web applications, mobile apps, APIs, networks and cloud environments, and is required or expected by PCI DSS, ISO 27001 and most financial regulators.

Penetration testing finds as many vulnerabilities as possible within a defined scope. Red teaming simulates a real attacker pursuing a specific objective, such as reaching payment systems, to test whether your people, processes and detection tools catch them. Most organisations start with penetration testing and add red teaming as their defences mature.

We test web applications, mobile apps (iOS and Android), APIs, internal and external networks, cloud environments (AWS, Azure and GCP), wireless networks, AI models and chatbots, and employee resilience to phishing through our PhishBox simulation platform.

Run penetration testing at least once a year and after any significant change to your systems. PCI DSS requires internal and external penetration testing every 12 months and after significant changes, and many financial regulators expect the same or more frequent testing for critical systems.

You receive an executive summary for leadership and a technical report with each vulnerability's risk rating, evidence, reproduction steps and remediation guidance. We then retest your fixes and issue an updated report, so auditors and regulators can see issues were closed, not just found.

Not if it is planned properly. We agree rules of engagement, testing windows and escalation contacts before testing starts, use high-risk techniques only with your explicit approval, and can test in staging environments where production risk is unacceptable.

AI red teaming is adversarial testing of AI models, chatbots and AI agents to find ways they can be manipulated, made to leak data or made to take unsafe actions. It covers attacks such as prompt injection and jailbreaks that traditional penetration testing does not test for.

Prompt injection is an attack where malicious instructions, hidden in a user message, document, email or web page, override an AI system's intended behaviour. It can make a chatbot reveal confidential data or make an AI agent take actions it should not. It is ranked the top risk in the OWASP Top 10 for LLM Applications.

SATLAS.ai is SandBox Security's AI red-teaming platform. It runs automated adversarial attacks against your AI models, chatbots and agents, then reports which attacks succeeded, how severe they are and how to fix them. Testing is aligned to MITRE ATLAS and the OWASP Top 10 for LLM Applications, with mapping to the EU AI Act and ISO/IEC 42001.

Yes. SATLAS.ai runs as SaaS or on-premises, including fully air-gapped deployments with no outbound network connection. This suits banks, government entities and other organisations whose data or models cannot leave their own infrastructure.

Start with a proof of concept against one of your AI applications. We agree the scope and success criteria with you, run SATLAS.ai against the target and walk your team through the findings, so you can judge the platform on your own systems rather than a demo.

Often, yes. If tools such as ChatGPT, Copilot or a vendor chatbot are connected to your internal data, customer channels or business workflows, the integration is your risk even though the model is not yours. A short AI risk assessment shows whether full testing is needed.

Every engagement starts with a free scoping call. We learn about your environment, regulatory drivers and deadlines, then send a written proposal with scope, deliverables, timeline and fixed cost.

Cost depends on scope: the number of applications, systems or locations, the frameworks involved and how ready you are. Most SandBox Security engagements are fixed-fee against a defined scope, so you know the cost before we start. Ongoing services such as compliance sustenance are priced annually.

We sign an NDA before any sensitive information is shared and operate under our ISO/IEC 27001-certified information security management system. Evidence and test data are handled only on approved, access-controlled systems, and are returned or securely deleted at the end of the engagement.

Yes. We deliver cybersecurity training for security teams, developers, technical staff and leadership, from hands-on technical programmes to executive and board briefings, on-site or online.

Email contactus@sandboxsecurity.ai or use the contact form on this website with a short description of what you need. A practitioner from our team will respond within one business day to arrange a scoping call.