Penetration testing in Saudi Arabia

Regulations we test against

SAMA Cyber Security Framework

Financial institutions regulated by the Saudi Central Bank are expected to run regular independent penetration tests and to evidence remediation. Our banking reports are structured around the SAMA CSF domains, so each finding lands in the right place in your audit evidence. For objective-based exercises, SAMA's Financial Entities Ethical Red Teaming (FEER) framework sets the process; our red team work follows its phases when you run one.

NCA controls

Government entities and critical national infrastructure align to the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC). Depending on the entity, the Cloud Cybersecurity Controls (CCC), the Critical Systems Cybersecurity Controls (CSCC) and the Operational Technology Cybersecurity Controls (OTCC) apply too. Findings reference the relevant control identifiers.

Personal Data Protection Law

The PDPL, supervised by SDAIA, applies to organisations processing personal data in the Kingdom. Findings that expose personal data are flagged so your data protection officer can assess the impact under the law.

PCI DSS

Card processors and large merchants fall under requirement 11. Reports include the segmentation checks your QSA will ask about.

Data residency

Many Saudi clients require data and evidence to remain in the Kingdom. We support in-Kingdom evidence storage, and for the strictest programmes we work entirely on your infrastructure and hand evidence over on your media, so nothing leaves the site.

What is usually in scope

Saudi scopes typically include open-banking and partner APIs, retail and corporate digital banking, mobile applications, the identity and access layer that connects to national services, and the perimeter with its VPN and email edges. Government entities add citizen platforms and shared services. Energy, petrochemical and industrial clients add OT: process networks, historians and the paths between corporate and plant. Internal assessments cover Active Directory, segmentation and the remote access used by integrators and vendors.

Delivery model

External, web, mobile and API testing runs remotely from Muscat, one hour ahead of Riyadh. Internal and OT work runs on-site, with testers travelling to Riyadh, Jeddah, Dammam or industrial sites in the Eastern Province, or through a drop-box shipped to your site where your policy allows one.

Procurement and localisation

Saudi procurement often carries registration and local-content requirements, and some programmes ask for a locally licensed provider. Where that applies we deliver through a Saudi partner of your choice, with our testers named on the engagement and the same report and retest terms. Scoping runs online or on-site in Riyadh, in Arabic or English, with rules of engagement, excluded systems and test windows confirmed in writing. Testing runs with daily syncs and same-day reporting of confirmed criticals, and the free retest within 90 days closes the SAMA or NCA evidence trail without a second procurement.

Time-zone coverage

Arabia Standard Time, UTC+3, one hour behind Muscat, with no daylight saving. Working week Sunday to Thursday, the same as ours.

Recent engagements

Bank, open-banking API estate

Authorisation gaps across partner-facing APIs let one fintech partner query another partner's consents. Findings were mapped to SAMA CSF and closed before the framework review.

Government entity, external perimeter

Exposed management interfaces and an outdated edge appliance listed in the CISA Known Exploited Vulnerabilities catalogue. Remediation was prioritised within the ECC cycle.

Industrial operator, OT assessment

Field network reachable from the corporate estate through a vendor VPN. Segmentation and jump-host design delivered with the site engineers and mapped to OTCC.

All engagements are anonymised and described with client approval.

Why Vulnera here

Saudi programmes move fast and expect evidence, not opinion. Every Vulnera finding is reproduced and comes with the request, the response and the fix. Arabic-speaking testers run interviews and workshops, reports are delivered in English with Arabic executive summaries on request, and our Fortinet and Cisco specialists review the edge devices that feature in so many Saudi findings. The full service description is on the penetration testing page.