Cybersecurity Insights & Expertise

QUICK ANSWER · BOTH FRAMEWORKS AUDIT EVIDENCE · 2026 Does ISO 27001 require a penetration test? Not by name. ISO/IEC 27001:2022 is risk based, but Annex A 8.8 (management of technical vulnerabilities) and Annex A 8.29 (security testing in development and acceptance) are the applicable controls, and ISO/IEC 27002:2022 names penetration testing in its implementation guidance. If those controls are marked applicable in your Statement of Applicability and you cannot show test evidence, that is a

× Running MCP servers in production? 40 plus CVEs in 2026 · Are you exposed? Schedule a Meeting → QUICK ANSWER · MCP SECURITY 40 PLUS CVES · 2026 The Model Context Protocol (MCP), released by Anthropic in November 2024, lets AI agents call external tools, APIs, files, and services through a standardised interface. Between January and April 2026, security researchers disclosed more than 40 CVEs against MCP implementations across Python, TypeScript, Java, and Rust SDKs. Estimated 200,000 MCP se

× August 2026 high risk AI deadline? Article 9 security testing · Ready? Schedule a Meeting → QUICK ANSWER · EU AI ACT AUG 2 2026 DEADLINE EU AI Act Regulation 2024/1689 Article 9 requires providers of high risk AI systems to establish, implement, document, and maintain a risk management system throughout the AI system lifecycle. The Act explicitly names security testing as a required control: Article 9(6) mandates testing before market placement and throughout development, Article 9(8) requi

× Raising? Investors ask about security. Pentest for VC diligence · 2 to 3 weeks Schedule a Meeting → QUICK ANSWER · FUNDRAISING SECURITY DEAL BLOCKER · 2026 A penetration test before fundraising is a scoped security assessment run in the weeks before a Series A, B, or growth round to produce the evidence a VC's technical due diligence team will ask for. In 2026 approximately 66% of VCs now conduct cybersecurity due diligence before funding, and Verizon's 2026 DBIR finds 31% of breaches now s

× Scan a few times a year? Skip the $4,790 licence · SME friendly quote Schedule a Cost Comparison Call → QUICK ANSWER · COST COMPARISON TCO ANALYSIS · 2026 Tenable Nessus Professional costs $4,790 per year for a single scanner with unlimited target IPs (Tenable published pricing, verified July 2026). Real total cost of ownership including scanner infrastructure, analyst time to interpret findings, compliance framework mapping, and reporting typically runs $8,000 to $15,000 in year one for an

× Small fleet, need real audit? Router, switch, firewall config audit · SME friendly Schedule a Scoping Meeting → QUICK ANSWER · NETWORK AUDIT PRICING TRANSPARENCY · 2026 Titania Nipper is a network configuration audit tool used by 30+ US federal agencies and 800+ organisations globally to assess firewalls, routers, and switches against CIS Benchmarks, NIST 800-53, PCI DSS, CMMC, STIGs, and other frameworks. Titania does not publish official pricing. Market intelligence from Gartner Peer In

× Integration blocked by security? API pentest with OWASP mapping · 2 week delivery Get an API Security Scoping Call → QUICK ANSWER · API INTEGRATION LAUNCH BLOCKER · 2026 An API security assessment for a partner integration is a scoped penetration test of the specific API surface your integration exposes, mapped to OWASP API Security Top 10 (2023), the partner platform's own security requirements, and any regulatory frameworks that apply (PCI DSS, GDPR, SOC 2). It covers authentication and

× Enterprise deal in security review? Pentest reports in 2 to 3 weeks · OSCP and CREST Get an Assessment Ready Pentest → QUICK ANSWER · ENTERPRISE SAAS DEAL BLOCKER · 2026 A vendor security assessment is the security evaluation an enterprise buyer runs before signing a contract with your SaaS company. It typically includes a security questionnaire (SIG Lite, SIG Core, CAIQ, VSAQ, or a custom buyer template), a request for supporting evidence (SOC 2 Type II report, ISO 27001 certificate, recen

× SCADA, PLCs, HMI in scope? OTCC-aware testing · Safety first methodology Get a Safety First OT Scoping → QUICK ANSWER · SAUDI ARABIA OT/ICS · HIGH STAKES An OT/ICS penetration test for Saudi critical infrastructure evaluates SCADA systems, PLCs, HMIs, Safety Instrumented Systems (SIS), engineering workstations, and the IT/OT network boundary against the threat models that matter in industrial environments. It is governed primarily by NCA's Operational Technology Cybersecurity Controls (OTCC

× Bidding into a giga project? NEOM, Qiddiya, Red Sea, Diriyah · NCA-registered audit Get an Honest Readiness Check → QUICK ANSWER · SAUDI ARABIA GIGA PROJECTS · 2026 Vendors supplying NEOM, Qiddiya, Red Sea Global, Diriyah Gate, and other Saudi giga projects face cybersecurity expectations from three overlapping sources: NEOM's published Cybersecurity Compliance Framework and Supplier Code of Conduct (June 2022), which require third-party suppliers to "provide reasonable assurance" of their

× SW Saudi AI compliance help? SDAIA · PDPL · NCA · 30 min scoping call Talk to Our Team → QUICK ANSWER · SAUDI ARABIA FIRST MOVER · 2026 An Arabic LLM security audit tests four risk surfaces that English-only evaluations miss: Arabizi (Arabic chatspeak) and transliteration jailbreaks that bypass refusals working in standard Arabic, dialectal jailbreak surface across Najdi, Hijazi, Egyptian, Moroccan, and Levantine variants, code-switching exploits mixing Arabic and English, an

SAUDI ARABIA · NCA REGISTERED Updated: June 21, 2026 $3B+ Saudi AI infrastructure GOVERNMENT INVESTMENT 7 SDAIA AI Principles SEPTEMBER 2023 SAR 5M PDPL maximum fine DOUBLED FOR REPEAT 72hr SDAIA breach window FROM AWARENESS Quick Answer: An AI security audit in Saudi Arabia must satisfy three overlapping regimes: SDAIA's AI Ethics Principles (fairness, privacy, accountability, plus 4 more), the Personal Data Protection Law (PDPL, fully enforced September 14, 2024), and appli