Al-Qunfudhah's health system is a network, not a building. A district hospital, a scatter of outlying clinics along the coast and inland, referral links onward to Jeddah, and telehealth sessions that stand in for a specialist who is hours away. CyberFortify runs manual API, web, cloud and network penetration tests for organisations here, aligned to NCA ECC, the NCA Cloud Cybersecurity Controls and the Saudi PDPL. Delivered remotely in Al-Qunfudhah's time zone. Fixed price, audit-ready reporting, free remediation retest.
// 01 Why Al-Qunfudhah businesses need penetration testing
A referral is a handover, and handovers are where things get dropped. In Al-Qunfudhah the clinical work does not end at the district hospital's door - it continues along a chain that carries a person and their record onward to tertiary care in Jeddah, back down to an outlying clinic for follow-up, and across a telehealth link to a specialist who will never be in the same room. Every one of those steps is an interface between organisations that do not share a security team, a change calendar or, in many cases, the same idea of who is responsible for the data while it is in motion.
That is a different risk shape from the one most security programmes are built for. Internal systems get attention because someone owns them; the interface between two organisations gets less, because ownership is genuinely ambiguous - and because it usually works. Referral endpoints tend to trust their senders on the strength of a shared secret set up years ago, accept whatever structure arrives, and log little. Shared record access granted to a partner site outlives the arrangement that justified it. A telehealth platform sits in someone else's cloud tenancy with identity configuration nobody on either side has reviewed line by line.
The second half of the problem is availability. For a community an hour or more from an alternative, a referral pathway that will not respond is a clinical constraint on what care can be arranged today, not a service-desk ticket. Testing here is about knowing, before someone else finds out, whether a record can be altered in transit, whether an outlying site can be used as a route into the centre, and whether the pathway itself can be taken down. Continuity of care is the outcome the controls exist to protect.
// 02 Compliance and regulatory drivers in Al-Qunfudhah
Obligations here follow the record rather than the building. Where data crosses an organisational boundary, duties apply on both sides of it. These are the requirements CyberFortify most often maps evidence against for organisations in the governorate.
Saudi PDPL - heightened duties, shared data
Health data attracts the Personal Data Protection Law's stricter treatment, and those duties do not stop at a transfer. Sending and receiving organisations both hold security-of-processing obligations over a record moved between them; testing evidences the interface was validated.
Referral-record integrity in transit
A referral that arrives altered, duplicated or attributed to the wrong person is a clinical error with a technical cause. We test signing, transport protection, replay resistance and what the receiving endpoint will accept without question.
Pathway availability as a clinical safety control
For a dispersed population, an unavailable referral or telehealth link narrows the care that can be arranged. Availability belongs in the risk register as a safety control, and testing covers the denial-of-service and ransomware paths that threaten it.
NCA Cloud Cybersecurity Controls (CCC)
Telehealth and shared-record platforms are cloud-hosted and often third-party operated. The NCA's cloud controls expect assurance over identity, tenant isolation and the split of responsibility with the provider - all of it testable rather than assumed.
NCA Essential Cybersecurity Controls (ECC)
Public bodies, health organisations, the university branch and their suppliers fall under the NCA's ECC, whose Cybersecurity Defence domain requires periodic vulnerability assessment and penetration testing on a defined cycle.
ISO 27001:2022 - control A.8.29
A.8.29 asks for security testing across development and acceptance. Organisations here use it to bring integrations and telehealth platforms into scope at the point of change, not only at annual review - and to satisfy partner due diligence.
// 03 Penetration testing services for Al-Qunfudhah
Engagements in the governorate weight toward interfaces and the identities behind them. Health organisations usually lead with API and network testing; public bodies and the education sector lead with web and external perimeter; anyone running a cloud-hosted platform starts with cloud configuration.
API pen testing
Referral, records and integration interfaces - broken object-level authorisation, weak sender authentication, replay and the data one organisation exposes to another.
Cloud pen testing
Configuration-aware AWS, Azure and Google Cloud testing of telehealth and record platforms - identity, privilege, tenant isolation and storage exposure.
Network pen testing
External perimeter, internal and Active Directory testing, plus segmentation between the district hospital, outlying clinic links and shared services.
Web application pen testing
Patient portals, appointment systems, clinician-facing consoles and public-sector services tested against the OWASP Top 10 and business-logic abuse.
Mobile app pen testing
iOS and Android testing for consultation, appointment and staff apps used where a browser session on a slow link is not practical.
Red teaming
Goal-based adversary simulation, including ransomware scenarios modelled on the loss of the referral pathway rather than a single server.
// 04 How we deliver to Al-Qunfudhah
Al-Qunfudhah keeps our exact clock - Arabia Standard Time, UTC+3 - and the systems that matter most here are internet-facing, cloud-hosted or reachable over managed links, so they are tested remotely from our secure environment with no travel loaded into the quote. Scheduling is the part we take seriously: clinical activity sets the calendar, not the other way round.
What runs remotely
API, cloud, web and external perimeter testing delivered from our secure environment during local business hours, with consultation windows excluded and an escalation contact held open throughout. Arabic- or English-language read-outs.
What we do on-site
Internal network, wireless, segmentation and outlying-site assessment where physical presence adds value - arranged as a planned visit covering several locations in one trip rather than repeated journeys.
Every engagement opens with a free 30-minute scoping call and a fixed-price quote returned within the hour. Findings arrive with a remediation order that puts the interfaces carrying patient data first, and the free retest confirms fixes before the next audit cycle or platform change.
// 05 Industries we secure in Al-Qunfudhah
The governorate's economy runs on care, the sea and the land, with a public sector holding it together. CyberFortify tests across the sectors that shape its risk profile:
// 06 Our methodology
Every Al-Qunfudhah engagement follows the same disciplined, audit-defensible process CyberFortify runs worldwide, weighted here toward interoperability and identity - the places where two organisations meet and each assumes the other checked. Testing is grounded in the Penetration Testing Execution Standard (PTES) and NIST SP 800-115, with exploitation mapped to the relevant MITRE ATT&CK tactics and application testing driven by the OWASP methodology. As a CREST Accreditation Pathway firm, we lead with manual, human-driven testing - automation supports the tester, it never replaces one.
Scoping & rules of engagement
Targets, third-party platforms, cross-organisation interfaces, clinical constraints and escalation paths agreed in writing before any testing begins.
Fixed quote in 1hReconnaissance & threat modelling
Attack surface mapped along the pathway - where a record originates, who it passes to, what each side trusts and where the chain would fail.
ATT&CK alignedManual exploitation
Confirmed weaknesses are exploited and chained under controlled conditions, including authorisation abuse across organisational boundaries, with false positives eliminated by hand.
Controlled exploitReporting & free retest
Executive summary, CVSS-scored technical report and PDPL/NCA/ISO mapping - written so a clinical governance reader and an engineer can both act on it. Free retest once fixes ship.
Audit-ready// 07 Why CyberFortify for Al-Qunfudhah
A scan-and-report vendor
Automated output rebadged as a pen test, scoped to the assets one organisation happens to own - so the interface between two of them, where the record actually travels, is never looked at by anyone.
CyberFortify in the Gulf
A Gulf-based, CREST-pathway team in Al-Qunfudhah's own time zone that tests integrations end to end, treats availability of the pathway as a finding class in its own right, and maps every result to PDPL, NCA ECC and ISO 27001. Fixed pricing, free remediation retest.
Engagements here often pair an API test with a cloud assessment, since a referral or telehealth pathway is only as trustworthy as the interface it runs on and the tenancy it runs in.
// 08 Frequently asked questions
What does penetration testing cover on a referral pathway?
The pathway is an integration, so we test it as one. That means the interfaces that carry a referral out of a district hospital in Al-Qunfudhah and into a receiving organisation, the authentication between the two, the way each side proves the other is who it claims to be, and whether a record in transit can be read, altered or replayed. We also test what the receiving system will accept - many referral endpoints trust their sender far more than they should.
Can you test a telehealth platform without disrupting consultations?
Yes, and the scheduling is agreed before anything starts. Live consultation windows are excluded, disruptive test classes are run against staging or during agreed low-activity periods, and we hold an escalation contact throughout so anything unexpected is stopped immediately. Availability of a telehealth link matters clinically in Al-Qunfudhah, so we treat protecting it as part of the engagement rather than an afterthought.
How does the Saudi PDPL apply to records shared between organisations?
Health data carries heightened duties under the Personal Data Protection Law, and those duties travel with the record. When a district hospital sends a patient record to a tertiary provider or an outlying clinic, both the sending and receiving organisation carry security-of-processing obligations over that transfer. Testing is how you evidence that the controls on the interface between them were validated rather than assumed.
Do smaller clinics and outlying sites need testing too?
Often more than they expect. An outlying clinic is usually the least defended point on a shared network, and it holds credentials and a trusted connection into systems far larger than itself. Attackers pick the weakest connected site, not the most important one. We scope small sites proportionately - perimeter, remote access, segmentation and the interfaces they hold - rather than pricing them like a hospital.
Which regulations apply to penetration testing in Al-Qunfudhah?
Health and personal data falls under the Saudi PDPL; public bodies, the health sector and their suppliers fall under the NCA Essential Cybersecurity Controls, whose Cybersecurity Defence domain requires periodic vulnerability assessment and penetration testing; cloud-hosted telehealth and record platforms add the NCA Cloud Cybersecurity Controls; and organisations certifying to ISO 27001:2022 use testing as evidence for control A.8.29.