Bahrain is our home market. CBB licensees must penetration-test at least twice a year, in June and December, and report to the CBB by 30 September and 31 March. CyberFortify plans that cycle with you from Hidd, tests web, API, network and cloud estates, and delivers reports the regulator accepts. Fixed price, free remediation retest.
// 01 Who needs penetration testing in Bahrain
The strongest driver is the Central Bank of Bahrain. Banks, insurers, investment firms and payment providers that deliver services through digital channels carry a recurring testing obligation written into the CBB Rulebook.
Beyond finance, the Personal Data Protection Law covers any system holding personal data, PCI DSS applies to anyone touching card data, and enterprise buyers increasingly ask for a recent test before they sign. Most medium and large Bahraini organisations have at least one driver.
// 02 Compliance drivers in Bahrain
These are the obligations we map evidence against most often. The full rule-by-rule breakdown is in our CBB penetration testing requirements guide.
Twice a year: June and December
The Rulebook (e.g. GR-12.2.3, OM-5.5.28) requires licensees to test systems, applications and network devices at least twice a year, each June and December.
Reports by 30 Sept and 31 March
Results go to the CBB by 30 September (June test) and 31 March (December test), listing vulnerabilities, passed and failed tests and mitigation steps. Keep them for five years.
Rotate testers every two years
Testing must be done by independent third parties changed at least every two years. Due a rotation? We take over cleanly from your previous provider.
PDPL (Law No. 30 of 2018)
Data managers must apply appropriate technical measures to personal data. Testing shows those measures were validated, not assumed.
PCI DSS v4.0 Req. 11.4
Annual internal and external testing of the cardholder data environment, plus segmentation testing under 11.4.5.
// 03 Penetration testing services in Bahrain
Banks lead with network and API testing, fintechs with web and cloud. Regulated enterprises usually bundle several ahead of each CBB cycle.
Web application pen testing
Banking portals, customer dashboards and fintech platforms tested against OWASP and business-logic abuse.
API pen testing
Open-banking and payment APIs: object-level authorisation, token abuse and sponsor-bank trust boundaries.
Network & AD pen testing
External perimeter, internal Active Directory and CDE segmentation for head offices in Seef and the Financial Harbour.
Cloud pen testing
AWS, Azure and GCP configuration and identity testing, including workloads in the Bahrain cloud region.
Mobile app pen testing
iOS and Android testing for the mobile banking and wallet apps that dominate Bahraini retail.
Red teaming
Goal-based adversary simulation to test whether your SOC detects and contains a real intrusion.
// 04 Where we work in Bahrain
We are fifteen minutes from Manama and on-site anywhere in the Kingdom the same day.
Also serving: A'ali, Amwaj Islands, Budaiya, Diraz, Hamad Town, Hidd, Isa Town, Juffair, Seef.
// 05 How we deliver, timed to the CBB cycle
Internal, wireless and Active Directory work happens on your premises; external, web and API testing runs from our secure environment in your time zone. A typical engagement is one to three weeks of active testing and four to six weeks end to end, including remediation and retest.
The Bahrain-specific discipline is timing. Book six to ten weeks before each reporting deadline so findings are fixed and retested before the report goes to the CBB.
Scope the June test
Agree scope, test windows and rules of engagement in writing.
Book earlyTest
Human-validated testing of the agreed scope, with critical findings reported within 24 hours.
CBB windowFix and retest
Your team remediates; we retest free and update the report.
Free retestSubmit by 30 Sept
Report lists vulnerabilities, passed and failed tests and mitigation. Repeat for December and 31 March.
Audit-ready// 06 Industries we secure in Bahrain
// 07 Why CyberFortify in Bahrain
A fly-in scan-and-report vendor
Tool output rebadged as a pen test, on an offshore clock, with no CBB context and a report your compliance team has to rewrite before the deadline.
CyberFortify in Bahrain
A CREST accredited team headquartered in Hidd. Human-validated exploitation, reports mapped to the CBB, PDPL and PCI DSS, read-outs in Arabic or English, fixed pricing and a free retest.
// 08 Frequently asked questions
Is penetration testing mandatory in Bahrain?
For CBB licensees, yes: at least twice a year, in June and December, with reports due by 30 September and 31 March. Outside finance, the PDPL, PCI DSS and customer contracts are the usual drivers.
How often must CBB licensees change testing provider?
The Rulebook requires independent third-party testers to be changed at least every two years. If your rotation is due, we can take over from your previous provider and keep the reporting cycle intact.
What must a CBB penetration testing report contain?
The vulnerabilities identified, a full list of passed and failed tests, and the steps taken to mitigate the risks. Licensees must retain reports for five years. Ours are structured to that list.
Do you test on-site in Bahrain?
Yes. Our team is based in Hidd, so on-site internal, wireless and workshop engagements anywhere in the Kingdom are routine. External and application testing usually runs remotely.
How much does a penetration test cost in Bahrain?
Cost depends on scope: number and complexity of applications, user roles, and whether network, cloud or OT are included. After a free scoping call we return a fixed price. See our penetration testing cost guide.
Do you deliver read-outs in Arabic?
Technical reports are issued in English, the working language of Bahrain’s financial sector. Executive and board read-outs can be delivered in Arabic or English.