Each city page is written for its own market - the local regulators, the dominant sectors and the threats that actually matter there - not a generic template with the name swapped in. As a Bahrain-based, CREST Accreditation Pathway firm, we deliver on-site where proximity helps and remotely in the local time zone everywhere else. This hub grows as we add cities; Bahrain, Saudi Arabia and our first California cities are live now, with more of the United States in progress.
// BH Bahrain — 10 cities
Our home market. From our office in Hidd we cover the Kingdom end to end - the financial capital, the industrial islands, the residential towns and the coastal communities - each with testing shaped to its sector and its regulators, from the Central Bank of Bahrain to the PDPL. If you are a CBB licensee, start with our guide to CBB penetration testing requirements - the twice-yearly June and December testing cycle, the 30 September and 31 March reporting deadlines and what your submission must contain.
// SA Saudi Arabia — 45 cities
We deliver across the Kingdom remotely in the local time zone, with on-site engagements where they add value. Every Saudi page is mapped to its own regulators - the NCA's Essential and Operational Technology controls, the SAMA framework for banks, PCI DSS and the Saudi PDPL - and to the sector that actually drives each city, from government in Riyadh to trade in Jeddah and energy across the Eastern Province.
// CA California — 40 cities
Our first US market, and a different regulatory world. California pages are mapped to the stack that actually governs them - CCPA/CPRA and the CPPA's cybersecurity-audit duties, SOC 2, HIPAA, PCI DSS 4.0 and the NIST frameworks - not the Gulf regulators. We are Bahrain-based and say so plainly: there is no California office. Testing is delivered remotely with a deliberate daily overlap window, our evening against your morning, and on-site arranged where it is genuinely needed.
// ++ Expanding across the region
CyberFortify is extending its location coverage across the Gulf and international markets. More Saudi cities are rolling out, and pages for California and further afield are in preparation - built to the same standard, each mapped to its own regulators and sectors. Need testing in a city not yet listed? We already deliver across the GCC and globally.
Coming next · more of California
Saudi Arabia is complete at 45 cities. California is under way - the remaining cities across the Bay Area, Orange County, the Inland Empire and the Central Valley are rolling out next, each mapped to the US compliance stack rather than a template.
Not listed yet?
We serve clients across the GCC and internationally today. If your city is not here, contact us - we will scope a remote or on-site engagement wherever you operate.