Penetration Testing Services in Saudi Arabia
DERISK delivers continuous, expert-led penetration testing to organisations across the Kingdom — mapped to the NCA and SAMA requirements that define what adequate testing means in Saudi Arabia.
Security testing built
for Saudi Arabia’s risk profile.
Saudi Arabia has the most prescriptive cyber security regime in the GCC. The National Cybersecurity Authority’s Essential Cybersecurity Controls set explicit, auditable expectations for vulnerability management and penetration testing, and the Saudi Central Bank’s Cyber Security Framework adds its own obligations for financial institutions. For regulated entities, testing is not a discretionary spend — it is a control with a named owner and an audit trail.
Vision 2030 has also produced an unusual amount of greenfield digital infrastructure: giga-projects, new financial services, and government platforms built fast and at scale. New systems are where exploitable misconfiguration concentrates, and where an annual test scoped months in advance is least likely to cover what actually shipped.
Our model fits that reality. Agentic AI maps and probes your estate continuously as it changes, certified offensive security specialists validate every result, and findings land on the platform tagged to the NCA ECC or SAMA CSF control they affect — so the same engagement produces both the remediation work and the compliance evidence.
Regulations that apply
in Saudi Arabia.
Every finding is tagged to the specific control it violates, so your compliance team receives evidence-ready mappings rather than raw vulnerabilities.
NCA Essential Cybersecurity Controls (ECC)
The National Cybersecurity Authority’s baseline controls apply to government entities, critical national infrastructure and their service providers, with explicit vulnerability management and penetration testing requirements.
SAMA Cyber Security Framework
The Saudi Central Bank’s framework governs banks, insurers and financing companies, and sets out expectations for regular security testing and risk management.
NCA Cloud Cybersecurity Controls
Additional NCA controls apply specifically to cloud service adoption and the providers serving regulated Saudi entities.
Saudi Personal Data Protection Law
The PDPL governs personal data processing in the Kingdom and requires appropriate technical and organisational safeguards.
Sectors we work with in Saudi Arabia.
Available in Saudi Arabia.
The full DERISK catalogue is available to Saudi Arabia organisations. Remote engagements start immediately; on-site work is scheduled during scoping.
Network Pentest
Simulate real-world attacks across your external, internal, AD, and wireless networks.
Learn more ↗Cloud Security Assessment
Identify misconfigurations and risks across your cloud environments.
Learn more ↗Vulnerability Assessment
Systematic scanning to identify and prioritise known weaknesses.
Learn more ↗What we commit to.
First findings
Critical triage
Retest turnaround
Full report
Working with DERISK in Saudi Arabia.
Do you map findings to NCA ECC and SAMA CSF?
Yes. Each finding is tagged to the specific control it violates, so your compliance team receives evidence-ready mappings for NCA ECC and SAMA CSF alongside the technical remediation guidance, out of the same engagement.
Can testing be performed remotely from the UAE?
External testing, web and API assessments, cloud reviews and code review are all delivered remotely. Engagements requiring physical presence — internal network, wireless, physical social engineering — are arranged on site. Data residency and handling requirements are agreed during scoping.
How does continuous testing help with NCA compliance?
The ECC expects vulnerability management to be an ongoing process, not an annual event. Continuous testing produces a dated, auditable record of discovery, validation, remediation and retest — which is considerably easier to evidence than a single report.
How quickly will we see results?
Initial confirmed findings appear within 8 hours of kickoff, critical issues within 2 hours of discovery, retests complete within 24 hours of you marking a fix, and the full report arrives within 2 business days of engagement close.
Start testing in Saudi Arabia.
Tell us what you run and who regulates you. We will scope the right coverage in a single call.