How is a penetration test scoped?

We agree on targets, depth, and rules of engagement up front, test safely without disrupting operations, and deliver findings with severity, proof, and remediation steps.

Can you monitor our environment continuously?

Yes. Managed monitoring, endpoint detection, and log analysis can be set up as an ongoing service with defined escalation paths.

Do you review AI systems?

Yes. We assess AI and language-model features for prompt injection, data leakage, and unsafe model use before and after launch.

What does a security engagement deliver?

A security assessment report, a risk-prioritized roadmap, an incident response playbook, and an NCA ECC gap assessment when compliance is in scope.

ServicesService 05 of 08

CYBERSECURITY.

Safeguard applications, infrastructure, and data with enterprise-grade cyber security services. We test for weaknesses, monitor and respond to threats, harden architecture and identity, and help Saudi organizations meet NCA ECC and PDPL requirements, including security reviews for AI systems.

Deliverables

Security assessment report
Incident response playbook
NCA ECC gap assessment

Ideal for

Businesses handling sensitive data
Organizations preparing for compliance
Regulated industries in Saudi Arabia

Standards & scope

NCA ECC
PDPL
ISO 27001
SAMA CSF
OWASP
NIST CSF

01Outcomes

What changes when we are done

01
Know your real exposure
Prioritized findings across systems, access, and cloud, not a generic checklist.
02
Compliance-ready
Evidence and gap plans aligned with NCA ECC, PDPL, and sector frameworks.
03
Threats watched and handled
Monitoring plus a rehearsed response plan when something looks wrong.
04
Security that ships with you
Reviews built into design, code, and AI features before they go live.

02What we deliver

What we deliver

Every engagement is scoped from this catalog. Pick what you need, or ask us to shape it around your situation.

Assessment & testing

4 items

1.1
Vulnerability & penetration testing
Test web apps, mobile apps, and networks so exploitable gaps are found before attackers use them.
1.2
Security audits & gap assessments
Map your controls against ISO 27001, NCA ECC, or SAMA CSF and show what still needs closing.
1.3
Cloud & configuration reviews
Check cloud and infrastructure settings for misconfigurations that leave accounts and data exposed.
1.4
Source code review
Audit application code for insecure patterns before they ship into production.

Monitoring & response

4 items

2.1
Managed security monitoring
Stand up continuous monitoring, including SIEM or SOC-as-a-service, so threats are watched around the clock.
2.2
Endpoint detection & response
Deploy EDR so endpoints are watched, contained, and investigated when something looks wrong.
2.3
Incident response & forensics
Contain active incidents, preserve evidence, and reconstruct what happened so you can recover with confidence.
2.4
Log management & threat detection
Collect, retain, and analyze logs so unusual activity is visible instead of buried.

Hardening & architecture

4 items

3.1
Network & infrastructure hardening
Tighten servers, networks, and baselines so common attack paths are closed.
3.2
Identity & access management
Put MFA, least-privilege access, and SSO in place so the right people reach the right systems.
3.3
Secure cloud architecture
Design cloud environments with isolation, encryption, and least-privilege built in from the start.
3.4
Patch & vulnerability management
Run a repeatable program to find, prioritize, and close weaknesses on a schedule.

Governance & compliance

3 items

4.1
NCA ECC & compliance consulting
Write and operationalize policies against NCA Essential Cybersecurity Controls, the primary regulatory driver for Saudi clients.
4.2
PDPL data protection readiness
Prepare people, processes, and systems for Saudi Arabia's Personal Data Protection Law.
4.3
Security awareness training
Train staff to recognize phishing, handle data carefully, and follow day-to-day security practice.

Application security

3 items

5.1
Secure SDLC & DevSecOps
Build security checks into design, code, and release so issues are caught before production.
5.2
API security testing
Probe APIs for broken auth, data leaks, and abuse paths that never show up in a UI test.
5.3
AI & LLM security reviews
Review AI systems for prompt injection, data leakage, and unsafe model use before they go live.

03How we work

How we work

A clear four-step path from the first call to steady operation.

01 Assess
Scoping, testing, and audits produce a prioritized picture of risk and compliance gaps.
02 Plan
A remediation roadmap ranks fixes by impact and effort with clear owners.
03 Harden
We close gaps across network, identity, cloud, and application layers with your team.
04 Monitor & respond
Continuous monitoring, incident playbooks, and periodic retests keep the posture current.

04Questions, answered

Questions, answered

Straight answers on scope, timelines, and handover.

Yes. We run gap assessments against the NCA Essential Cybersecurity Controls, write and operationalize the required policies, and prepare evidence for audits.