Exploit3rs brings live cyberattack simulations to Dubai Municipality

Exploit3rs Cybersecurity Academy is delivering a series of hands-on cyberattack simulations at Dubai Municipality's Cybersecurity Week, running from 27 to 29 October 2026 at the Radisson Blu Hotel, Dubai Creek. The programme moves away from slide-deck awareness sessions, instead placing employees inside realistic attack scenarios designed to test decision-making under pressure.

Three formats make up the Exploit3rs offering. A Cyber Escape Room gives teams roughly 20 minutes to decrypt passwords, identify phishing emails and analyse digital evidence to unmask a simulated attacker. Interactive Cyber Missions run on touchscreen kiosks and take participants through five scenarios covering account compromise, password hygiene, USB risks, email phishing and fraudulent payment-change requests. A third strand, the "Who's Watching?" workshop led by Fares Hassanin, Head of Cyber Range and Education at the academy, includes two live demonstrations: one showing how opening a malicious email attachment can expose a webcam to remote access, another showing how an unpatched Windows machine can be compromised silently using a vulnerability from the same family as the 2017 WannaCry ransomware campaign.

Why experiential training is gaining traction

Juma Alshamsi, Founder and CEO of Exploit3rs, argued that conventional awareness programmes test recognition but not response. "Most cybersecurity awareness programmes show employees a suspicious email and ask whether they would have recognised it. The answer is often yes," he said. "Through our participation in Dubai Municipality's Cybersecurity Week, we are taking a more practical approach by giving employees the opportunity to construct simulated phishing scenarios themselves before encountering similar threats in realistic workplace situations."

The approach reflects a broader shift in corporate security training. Research by security vendors and independent bodies consistently shows that passive awareness content produces limited behaviour change; gamified and scenario-based learning, by contrast, is increasingly favoured by enterprise security teams seeking measurable uplift in phishing-resistance metrics. Competitors in this space include global vendors such as KnowBe4, Proofpoint Security Awareness, and Immersive Labs, all of which offer simulation platforms, though few bring the physical escape-room format into employer premises at scale.

Regulatory context and regional expansion

The UAE's National Electronic Security Authority (NESA) framework mandates baseline cybersecurity controls across critical-information infrastructure, and awareness training forms part of the compliance requirement. Exploit3rs says its programmes are aligned with NESA requirements and that it holds a licence from the Knowledge and Human Development Authority. For government entities subject to these obligations, experiential training formats that can generate participation records may carry compliance value beyond their educational effect.

Following Cybersecurity Week, the academy plans to make all three formats available to government entities and private-sector organisations across the UAE, allowing employers to host escape rooms on-site and deploy kiosk-based missions. Exploit3rs reports having trained approximately 4,000 individuals and run more than 23 specialised events since its founding, and operates a dedicated cyber-range platform called Hacking Dungeon for more technical vulnerability-discovery exercises.

The academy received the Judges' Choice Award at North Star Startups during GISEC Global 2025 and the Startup of the Year Award at the CyberAI Summit and Awards 2025, suggesting it has begun building a regional profile. Whether it can translate event-based engagements into recurring enterprise contracts will be the key commercial test as it moves into a market where well-capitalised global platforms already hold long-term security-awareness agreements with large organisations.