Cities we serve with local, manual penetration testing.

// BH Bahrain — 10 cities

Our home market. From our office in Hidd we cover the Kingdom end to end - the financial capital, the industrial islands, the residential towns and the coastal communities - each with testing shaped to its sector and its regulators, from the Central Bank of Bahrain to the PDPL. If you are a CBB licensee, start with our guide to CBB penetration testing requirements - the twice-yearly June and December testing cycle, the 30 September and 31 March reporting deadlines and what your submission must contain.

// SA Saudi Arabia — 45 cities

We deliver across the Kingdom remotely in the local time zone, with on-site engagements where they add value. Every Saudi page is mapped to its own regulators - the NCA's Essential and Operational Technology controls, the SAMA framework for banks, PCI DSS and the Saudi PDPL - and to the sector that actually drives each city, from government in Riyadh to trade in Jeddah and energy across the Eastern Province.

// CA California — 80 cities

Our first US market, and a different regulatory world. California pages are mapped to the stack that actually governs them - CCPA/CPRA and the CPPA's cybersecurity-audit duties, SOC 2, HIPAA, PCI DSS 4.0 and the NIST frameworks - not the Gulf regulators. We are Bahrain-based and say so plainly: there is no California office. Testing is delivered remotely with a deliberate daily overlap window, our evening against your morning, and on-site arranged where it is genuinely needed.

// ++ Expanding across the region

CyberFortify is extending its location coverage across the Gulf and international markets. More Saudi cities are rolling out, and pages for California and further afield are in preparation - built to the same standard, each mapped to its own regulators and sectors. Need testing in a city not yet listed? We already deliver across the GCC and globally.