Most medium and large Saudi organisations carry a testing obligation, usually more than one: NCA ECC for government and critical sectors, SAMA CSF for financial firms, the PDPL for personal data and PCI DSS for card data. CyberFortify scopes once and maps the same evidence to each, so one engagement serves several assessors. Fixed price, free remediation retest.
// 01 Who needs penetration testing in Saudi Arabia
Government entities and their affiliated companies, and private owners or operators of critical national infrastructure, must implement the NCA Essential Cybersecurity Controls. SAMA-regulated banks, insurers and financing companies answer to the SAMA Cyber Security Framework.
Add the PDPL for any organisation processing personal data, OTCC for industrial operators, and the enterprise customers who now expect a recent test before contract. A Saudi bank is often under SAMA, NCA, PDPL and PCI DSS at once.
// 02 Compliance drivers in Saudi Arabia
Read the detail in our guides to NCA ECC and SAMA CSF penetration testing.
ECC-2:2024 control 2-11
Penetration testing of all externally provided services — websites, web and mobile apps, email, remote access — conducted periodically.
CSCC: every six months
Critical systems must be penetration-tested at least once every six months under the Critical Systems Cybersecurity Controls.
SAMA CSF control 3.2.4
Customer and internet-facing services are subject to annual review and penetration testing. SAMA expects maturity level 3 or higher.
FEER red teaming
SAMA’s ethical red-teaming framework requires intelligence-led red teaming of regulated institutions at least every three years.
OTCC-1:2022 control 2-10
Industrial and OT environments carry their own penetration testing control. We test them safety-first.
PDPL & PCI DSS
Security testing of personal-data systems under the PDPL; annual and change-driven CDE testing under PCI DSS 11.4.
// 03 Penetration testing services in Saudi Arabia
Ministries and giga-project suppliers prioritise web and cloud; banks lead with network and API; industrial operators add OT. Most programmes combine several.
Web application pen testing
E-government services, banking portals and contractor platforms tested against OWASP and business-logic abuse.
API pen testing
Payment, open-banking and integration APIs, including the partner integrations giga-projects depend on.
Network & AD pen testing
External perimeter, internal Active Directory and segmentation for head offices and data centres.
Cloud pen testing
Configuration-aware testing of AWS, Azure, GCP and in-Kingdom cloud providers under NCA cloud controls.
Mobile app pen testing
iOS and Android apps in scope of ECC 2-11, which names smartphone and tablet applications explicitly.
Red teaming
Intelligence-led adversary simulation, including FEER-style engagements for SAMA-regulated institutions.
// 04 Where we work in Saudi Arabia
Remote testing reaches the whole Kingdom. For on-site work, the Eastern Province is a drive across the King Fahd Causeway from our Bahrain base, and Riyadh and Jeddah a short flight.
Also serving: Ad-Dilam, Al-Baha, Al-Mubarraz, Al-Muzahmiyya, Al-Qunfudhah, Al-Saih, Al-Zulfi, Ar Rass, Arar, Bareq, Buraydah, Dawadmi, Dhahran, Duba, Dumat al-Jandal, Hail, Hofuf, Jizan, Jubail, Khafji, Khamis Mushait, Majmaah, Medina, Najran, Qatif, Rabigh, Rafha, Sabya, Saihat, Tabarjal, Taif, Turaif, Umluj, Unaizah, Wadi Al-Dawasir, Yanbu, al-Ula.
// 05 How we deliver in Saudi Arabia
External, web, API and cloud testing runs remotely in the Kingdom’s own time zone. Internal network, Active Directory, wireless and assumed-breach work is done on your premises on an agreed schedule. Data residency and handling are agreed in writing during scoping.
Expect one to three weeks of active testing and four to six weeks end to end, including remediation and retest. Book six to ten weeks before any NCA or SAMA reporting date.
Map your control set
We confirm which of ECC, CSCC, OTCC, SAMA CSF, PDPL and PCI DSS apply before scoping.
One scopeTest
Human-validated exploitation with critical findings reported within 24 hours.
ControlledReport per assessor
Findings mapped to each control reference your assessors check.
Audit-readyRetest
Free retest after remediation, with the report updated to show closure.
Free retest// 06 Industries we secure in Saudi Arabia
// 07 Why CyberFortify in Saudi Arabia
A scan-and-report vendor
Generic tool output with no control mapping, which your NCA or SAMA assessor sends back close to the deadline.
CyberFortify in the Kingdom
A Gulf-based, CREST accredited team in your time zone. Real exploitation, findings mapped to ECC, CSCC, SAMA CSF and PDPL, Arabic or English read-outs, fixed pricing and a free retest.
// 08 Frequently asked questions
Is penetration testing mandatory in Saudi Arabia?
For most regulated organisations, yes. NCA ECC control 2-11 requires periodic testing for government entities and critical-infrastructure operators; CSCC requires critical systems to be tested every six months; SAMA CSF 3.2.4 requires annual testing of customer and internet-facing services.
Does NCA ECC require annual penetration testing?
No. ECC says “periodically”, not annually. The six-month interval comes from the CSCC for critical systems. Most entities settle on at least an annual cycle, justified by risk.
What is the difference between NCA ECC and SAMA CSF?
They run in parallel. ECC covers government and critical sectors; SAMA CSF covers SAMA-regulated financial institutions. A bank classed as critical infrastructure is subject to both, so we map one engagement to both.
Do you provide on-site testing in Riyadh and Jeddah?
Yes. Remote testing covers most scopes; for internal, wireless and assumed-breach work our team travels to your premises on an agreed schedule.
How much does penetration testing cost in Saudi Arabia?
It depends on scope: applications, network size, cloud and OT. After a free scoping call we return a fixed price. See our cost guide.
Can you keep test data in the Kingdom?
Data handling and residency requirements are agreed in writing during scoping, before any testing starts.