Penetration Testing in Saudi Arabia
Most penetration tests in the Kingdom are bought because a regulator requires one. NCA's Essential Cybersecurity Controls, the Critical Systems controls and SAMA's framework each mandate testing on their own schedule - and each expects evidence an assessor can read. This is what that work involves and how I deliver it.
What the Saudi regulators actually require
Three separate regimes mandate penetration testing in the Kingdom, and which one applies to you decides the scope, the frequency and the evidence you need to keep.
NCA Essential Cybersecurity Controls (ECC)
The National Cybersecurity Authority's ECC is the national baseline, and it binds government entities, their contractors, and critical-infrastructure operators. Control 2-11 covers penetration testing: the requirements must be defined, documented and approved, they must be implemented, and the scope must cover internet-facing services and the technical infrastructure behind them. Testing is periodic, and the evidence an assessor looks for is the full cycle - scope document, test report, remediation, retest - not just a PDF with a date on it.
Critical Systems Cybersecurity Controls (CSCC)
If any of your systems are classified as critical, the CSCC raises the bar: those systems must be tested at least every six months rather than annually. This catches a lot of organisations out, because the budgeting and the procurement cycle are usually built around one test a year. Classify early, because a six-month cadence changes the commercial shape of the engagement entirely.
SAMA Cyber Security Framework
Financial institutions supervised by the Saudi Central Bank - banks, insurers, finance companies, payment service providers - are expected to run independent external penetration tests at minimum annually, covering internet-facing systems, web applications and network infrastructure. Independence is the operative requirement: testing performed by the team that builds or runs the system does not satisfy it, and neither does a vulnerability scan presented as a penetration test.
And the ones that sit alongside
SDAIA's Personal Data Protection Law brings its own security obligations where personal data is processed, the Cloud Cybersecurity Controls apply where workloads sit with a cloud provider, and large enterprises increasingly impose their own supplier security standards - Aramco's third-party requirements being the example most Saudi vendors meet first. Where you take card payments, PCI DSS Requirement 11.4 applies on top of everything above; that's covered on the PCI DSS testing page.
What a test actually covers
The scope that satisfies ECC 2-11 and SAMA in practice, in the order it's usually run:
- External network testing - everything your organisation exposes to the internet: VPN concentrators, mail, remote access, forgotten staging hosts and the services nobody remembers publishing. This is explicitly in scope for ECC 2-11 and it is where the majority of real intrusions begin.
- Web and API testing - authentication, authorisation, business logic and injection against your customer-facing applications and the APIs behind them. Named in the SAMA scope.
- Internal network testing - what someone who already has a foothold can reach: segmentation that doesn't hold, flat networks, credentials cached where they shouldn't be.
- Active Directory - ADCS certificate-template abuse, Kerberoasting, delegation problems and ACL paths to Domain Admin. Almost every Saudi enterprise runs on AD, and it is where an external foothold turns into a full compromise.
- Cloud - Entra ID and Azure RBAC escalation paths, exposed storage, and the identity misconfigurations that make a cloud tenant a shortcut rather than a barrier.
What you receive
A report written to be read by two audiences at once: an executive summary that a board or a regulator can follow without a translator, and a technical body with reproduction steps, evidence and CVSS ratings that your engineers can act on directly. Each finding is mapped to the control that required the test, so an assessor can trace the obligation to the evidence without you building that mapping yourself.
Remediation support is included rather than sold separately - questions during fixing get answered - and so is a retest of the findings you've closed, plus an attestation letter stating that the test was performed, by whom, against what scope and on what dates. In my experience the attestation is the document that actually gets filed with the auditor or sent to the enterprise client asking for proof. There's a sample report if you want to see the format before committing.
Why work with an independent consultant
You talk to the person doing the testing. There is no account manager relaying questions, no junior running a scanner under a senior's name on the invoice, and no three-week gap between the test finishing and the report arriving. For an ECC or SAMA deadline that directness is usually the difference between making the date and explaining why you didn't.
The practical fit for the Gulf is worth stating plainly: I work from Amman on GMT+3 - the same working hours and the same week as Riyadh, Jeddah and Dammam - so a question raised during testing is answered the same day. Arabic and English both work for the engagement. I hold OSCP+ along with eCPPT, eWPT, eCIR, AZ-500, SC-200 and SC-300, all independently verifiable in the OffSec credential wallet - which matters here, because assessors reviewing a test increasingly ask who performed it and what they hold.
What I will not do is pretend to be a local firm. I have no Riyadh office and I'm not going to claim one. What I am is a specialist you engage directly, in your time zone and your language, with credentials you can verify in thirty seconds.
Getting started
Tell me the control you need to satisfy - ECC 2-11, a CSCC six-month cycle, a SAMA annual test - plus what's in scope and your deadline. You get a fixed-price quote and a start date back, not a discovery process. If you'd rather see something concrete first, the free perimeter scan shows what your external surface currently exposes, and the compliance overview covers how the other frameworks compare.
If you're not sure which regime applies to you, that's a normal question and a short call settles it. Get in touch - enquiries in Arabic are welcome.
Saudi Arabia: common questions
Yes. Control 2-11 of the Essential Cybersecurity Controls covers penetration testing specifically, and it has three parts: the requirements must be defined and documented, they must be approved, and they must be implemented. The scope must cover internet-facing services and the technical infrastructure behind them, at minimum. Testing is required periodically. If you fall under the Critical Systems Cybersecurity Controls as well, critical systems must be tested at least every six months rather than annually.
Institutions regulated by the Saudi Central Bank are expected to run independent external penetration tests at minimum annually, covering internet-facing systems, web applications and network infrastructure. The word that carries the most weight there is independent - a test run by the team that built or operates the system does not satisfy it. For banks, insurers, finance companies and payment providers this is an annual recurring obligation, not a one-off.
For external, web application, cloud and most internal testing, no - the work is done remotely, which is how the large majority of assessments in the region are delivered. Internal network and Active Directory testing is handled over a VPN or a small jump host you control, and I can work from a jump box inside your environment where your policy requires it. If you have a data-residency requirement that puts constraints on where evidence is stored or processed, say so at scoping and it goes into the rules of engagement in writing.
That is what it is written for. Each report carries an executive summary for the board, a technical body with reproduction steps and CVSS ratings, mapping to the control that required the test, and a remediation section written so your engineers can act on it without a follow-up call. Retesting of the fixed findings and an attestation letter confirming the test was performed, by whom and against what scope are included - the attestation is usually the document an assessor or a client actually files.
English by default, which is what regulators and most Saudi enterprise procurement work in. Arabic is available on request, and day-to-day communication during the engagement can be entirely in Arabic. I work from Amman on GMT+3, the same working week and the same hours as Riyadh, so questions during testing get answered the same day rather than overnight.
Have an NCA or SAMA deadline?
Tell me the control you need to satisfy and the scope, and you'll get a fixed quote and a date.