Penetration testing in Oman

Regulations we test against

Central Bank of Oman

Banks and other CBO-licensed institutions are expected to commission independent penetration tests of internet banking, mobile channels, payment switches and core banking, and to show that what was found has been fixed. Our banking reports tag each finding with the CBO requirement it relates to, add PCI DSS references where card data is in scope, and include the retest result, so the audit file is complete in one pack.

Government cybersecurity controls

Ministries and government entities work to the cybersecurity policies and baseline controls issued through the Ministry of Transport, Communications and Information Technology (MTCIT), with incident coordination through the national CERT. Our government reports are organised by those control areas, with a one-page summary for the entity's security committee.

Personal Data Protection Law

Oman's Personal Data Protection Law (Royal Decree 6/2022) and its executive regulations apply to any organisation processing personal data in the Sultanate. When a finding exposes customer or employee data we flag it, so your data protection lead can judge whether it triggers an obligation under the law.

Telecoms, energy and utilities

Operators licensed by the Telecommunications Regulatory Authority, and oil, gas and utility companies with OT estates, carry sector expectations on top of the national baseline. We test SCADA and DCS networks, historians and the corporate-to-plant boundary with rules of engagement written for production sites, and report zoning gaps against ISA/IEC 62443 concepts.

ISO/IEC 27001 and PCI DSS

Most Omani clients hold ISO/IEC 27001 or are working towards it, and card issuers and acquirers fall under PCI DSS requirement 11. Every finding carries the control reference your auditor asks for.

What is usually in scope

Omani engagements usually start with the internet-facing estate: the corporate website, internet banking or customer portals, mobile applications and the APIs behind them, then the VPN and email edges. Internal assessments cover the Active Directory domain, the core banking or ERP network, wireless in branches and head office, and the remote access paths used by vendors. Oil and gas and utility clients add OT: the historian, engineering workstations and the jump hosts between corporate and plant networks. Government entities add the shared services that connect to national platforms.

Delivery model: on-site, remote or drop-box

Muscat is home, so internal network, wireless and physical assessments in the capital run on your premises with no travel cost. For Sohar's industrial zone, Salalah, Duqm and interior oil and gas sites we travel, or ship a hardened drop-box for a remote internal test. External, web, mobile and API testing runs from our Muscat office with a daily sync on your preferred channel. By default, evidence is stored on infrastructure in Oman and deleted 90 days after the report unless you ask otherwise.

How an Omani engagement runs

Scoping happens in your office in Muscat or online, in Arabic or English. Rules of engagement, test windows and excluded systems are agreed in writing, and for banks the testing calendar is set around month-end and salary-day processing. Testing runs with a daily sync, and criticals are reported the day they are confirmed. The report is walked through twice: once with your engineers, once with your risk or audit committee. The retest is booked with the fix plan and is free within 90 days. If you need a scenario-based exercise rather than a scoped test, see red teaming.

Time-zone coverage

Gulf Standard Time, UTC+4, with no daylight saving. Our working week is Sunday to Thursday, 08:00 to 17:00. Out-of-hours testing on production systems, including Ramadan schedules and weekend change windows, is arranged in advance.

Recent engagements

Regional bank, web and mobile banking

An authentication bypass chained with an IDOR gave full account takeover across roughly 40,000 customers. Three criticals were fixed and retested within 11 days, ahead of the regulator's review.

Government entity, secure switching rollout

802.1X, segmentation and hardened baselines for 3,000 ports across two campuses. Zero findings at retest.

Utility, OT segmentation

IT/OT zoning, jump-host architecture and vendor access controls for a SCADA estate. Purdue level 2 and 3 zones established with no production impact.

All engagements are anonymised and described with client approval.

Why a Muscat-based team

Being local changes the engagement. We know the core banking platforms in use, the Fortinet and Cisco estates that sit in front of them, and the vendors that hold remote access. Our testers speak Arabic and English and hold the clearances and NDAs that regulated environments require, and our free Labs and CTF platform is where many Omani security students practise. That matters when a finding has to be explained to a board on Tuesday and fixed by an engineer on Wednesday. The full service description is on the penetration testing page.