Penetration Testing Services in Saudi Arabia
Manual penetration testing for KSA banks and fintechs, government entities and their suppliers, healthcare providers, and SaaS companies selling into the Kingdom. Reports mapped to NCA ECC control 2-11 and the SAMA Cyber Security Framework, delivered by OSCP, OSWE and CISSP-certified testers, fixed-price and invoiced in Saudi Riyal.
Penetration Testing for KSA Organisations
Saudi regulators expect evidence that security controls work, not just that they exist. A penetration test is that evidence. We test the systems your regulator, auditor or enterprise customer cares about and report in a format they accept.
Banks, Fintechs & Insurers
SAMA-regulated Member Organisations that need annual tests of customer and internet facing services and evidence for SAMA CSF assessments.
Government Entities & Suppliers
Government bodies and the vendors that serve them, working to NCA ECC control 2-11 and contractual security requirements.
Healthcare
Hospitals, telehealth platforms and health-data processors protecting patient data under NCA ECC and PDPL.
SaaS Selling Into KSA
Local and international SaaS and cloud providers answering security questionnaires and NCA CCC requirements from Saudi customers.
What Saudi Regulations Expect From Penetration Testing
The National Cybersecurity Authority (NCA) and the Saudi Central Bank (SAMA) each set penetration testing expectations. Here is what each framework actually says, and how we scope tests to meet it.
NCA ECC-2:2024
Penetration testing requirements must be identified, documented and approved (2-11-1), implemented (2-11-2) and periodically reviewed (2-11-4). Control 2-11-3 sets the minimum: scope must include all externally provided services and their technical components, including infrastructure, websites, web applications, smartphone and tablet applications, email and remote access, and tests must be conducted periodically.
How we help: We scope your full internet-facing estate against 2-11-3 and deliver a report you can file as evidence for 2-11-2.
NCA CCC-2:2024
The Cloud Cybersecurity Controls extend ECC 2-11-3. For cloud service providers, control 2-10-P-1-1 requires penetration tests to cover the cloud technology stack and to be conducted at least once every six months. Cloud tenants test their own cloud-hosted services under ECC 2-11.
How we help: We test tenant workloads, cloud configuration and, for providers, the cloud technology stack on a six-month cadence.
NCA OTCC-1:2022
The Operational Technology Cybersecurity Controls extend the ECC to OT and industrial control system environments and include a dedicated penetration testing subdomain (2-10) in the Cybersecurity Defense domain. OT testing has to protect safety and availability first.
How we help: We use passive discovery, agreed maintenance windows and test or replica environments for anything that cannot tolerate active testing.
SAMA Cyber Security Framework
Subdomain 3.2.4 (Cyber Security Review) states that customer and internet facing services should be subject to annual review and penetration tests. Subdomain 3.3.7 (Change Management) lists penetration testing as part of security testing for changes where applicable, and 3.3.14 (Cyber Security Event Management) calls for independent periodic testing of the security operations centre, for example red-teaming.
How we help: We run the annual 3.2.4 test, pre-release tests for significant changes, and red team exercises that measure SOC detection.
SAMA F.E.E.R.
SAMA's Financial Entities Ethical Red Teaming Framework guides Member Organisations through threat intelligence based red teaming tests against the live production environment, with SAMA leading implementation. It is distinct from a penetration test, which assesses specific information assets.
How we help: Our red team engagements help security teams rehearse realistic attack scenarios and close detection gaps before a formal exercise.
PDPL
The PDPL, fully enforceable by SDAIA since 14 September 2024, requires controllers to put organisational, administrative and technical measures in place to protect personal data. It does not prescribe penetration testing by name, but a test of the systems that store and process personal data is the clearest evidence that technical measures work.
How we help: We prioritise systems that hold personal data and flag findings that could lead to a reportable breach.
Need the full picture? Read our guides to NCA penetration testing requirements, SAMA penetration testing and the NCA ECC compliance checklist.
Types of Penetration Tests We Deliver in KSA
One team covering every layer in the ECC 2-11-3 scope and beyond, from internet-facing infrastructure to industrial control systems.
Our Process and Timelines
Predictable engagements that fit your audit calendar, with safe testing in production and no waiting weeks for a PDF.
Scoping & Rules of Engagement
A 30-minute call to map your assets to the controls you answer to (ECC, CCC, OTCC or SAMA CSF). You receive a fixed-price proposal in SAR within 24 hours, followed by agreed rules of engagement, testing windows and emergency contacts.
Manual Testing
OSCP, OSWE and CISSP-certified testers carry out 100% manual testing using non-destructive techniques. Typical durations: web application 1 to 2 weeks, API around 1 week, network 2 to 3 weeks.
Real-Time Findings
Every validated finding is published to our SLASH platform as soon as it is confirmed and synced to Jira, so developers and infrastructure teams can start fixing during the test.
Reporting & Retesting
You receive an audit-ready report, then free, unlimited retesting with each retest completed within 48 hours of you marking issues as fixed. The report is updated to show closed findings.
Testing production without disruption
Most Saudi organisations cannot take customer-facing or government services offline for a test. We use non-destructive techniques, agree testing windows with your operations team, keep a named contact on call throughout, and avoid denial-of-service style tests unless you request them. Where a system is too fragile for live testing, such as OT/ICS controllers or core banking components, we test in a staging or identical separate environment instead.
Deliverables for Regulators and Auditors
A report your NCA assessor, SAMA examiner or internal audit team can work with, plus proof that findings were fixed.
Executive Summary
A plain-language view of overall risk for your board, CISO and regulator, with Arabic-language summaries on request.
Control Mapping
Scope and findings mapped to the controls you are assessed against: NCA ECC 2-11, CCC 2-10, OTCC 2-10 or SAMA CSF 3.2.4.
Risk-Rated Findings
Each issue rated by severity with affected assets, reproduction steps, evidence and business impact.
Remediation Guidance
Fix recommendations written for your developers and infrastructure team, not generic scanner output.
Methodology & Scope Statement
A clear record of what was tested, when, how and by whom, which is what auditors ask for first.
Retest Evidence
An updated report after retesting so you can show remediation, not just a list of open issues.
Fixed-Price Penetration Testing, Invoiced in SAR
No day-rate surprises and no currency risk for your finance team.
Scoped to your attack surface
Price is based on the applications, APIs, IP ranges, cloud accounts and user roles in scope, plus the frameworks you need the report mapped to.
Fixed price in Saudi Riyal
One agreed price, quoted and invoiced in SAR, with retesting included. The number on the proposal is the number on the invoice.
We beat competing quotes
Bring us any competing quote. We will beat it for equivalent scope without cutting certified testers, manual methodology or report quality.
Penetration Testing in Saudi Arabia: FAQ
How often does NCA ECC require penetration testing?
NCA ECC-2:2024 control 2-11 requires penetration tests to be conducted periodically, with scope covering all externally provided services and their technical components, but the ECC itself does not fix an interval. NCA's own penetration testing policy template, aligned with ECC and CSCC, sets testing of critical systems at least every six months, and the Cloud Cybersecurity Controls (CCC-2:2024) require cloud service providers to test their cloud technology stack at least once every six months. Most organisations test internet-facing services at least annually and critical systems every six months.
Does SAMA require annual penetration testing?
Yes, for internet-facing services. The SAMA Cyber Security Framework, subdomain 3.2.4 (Cyber Security Review), states that customer and internet facing services should be subject to annual review and penetration tests. Subdomain 3.3.7 (Change Management) also lists penetration testing as part of security testing for changes, where applicable.
Can you test our production environment safely?
Yes. We use non-destructive techniques, agree testing windows and rules of engagement with your team in advance, and avoid denial-of-service style tests unless you explicitly request them. For fragile or high-risk systems, including OT/ICS, we can test in a staging or identical separate environment instead.
How long does a penetration test take?
Typical timelines are 1 to 2 weeks for a web application, around 1 week for an API, and 2 to 3 weeks for an external and internal network test. Findings appear in real time in our SLASH platform during testing, so your team can start fixing before the final report is issued.
Is retesting included?
Yes. Every engagement includes free, unlimited retesting. Each retest is completed within 48 hours of you marking issues as remediated, and the report is updated so your auditor or regulator sees the closed findings.
How much does a penetration test cost in Saudi Arabia?
Cost depends on scope: the number of applications, APIs, IP ranges, cloud accounts and user roles, plus any regulatory reporting requirements. Every engagement is fixed-price and invoiced in Saudi Riyal. Bring us a competing quote and we will beat it for equivalent scope. Book a 30-minute consultation and we will send a scoped proposal within 24 hours.
Can we get the report in Arabic?
Our reports are written in English, and we provide Arabic-language summaries on request for boards, regulators or internal stakeholders who prefer Arabic.
Do you work with organisations outside Riyadh?
Yes. SecurityWall serves clients across the Kingdom, including Riyadh, Jeddah, Dammam, Khobar, Makkah and Madinah. Testing is delivered remotely, with on-site visits arranged where the engagement scope or regulator requires it, for example internal network or OT testing.
More Saudi Cybersecurity Services
NCA Compliance
ECC, CCC and CSCC gap assessments, implementation support and audit readiness.
Explore NCA servicesSAMA Compliance
SAMA Cyber Security Framework maturity readiness for banks, insurers and fintechs.
Explore SAMA servicesCybersecurity Services in Saudi Arabia
Our full KSA offering: testing, red teaming, NCA, SAMA and PDPL compliance.
See all KSA servicesBook Your Penetration Test in Saudi Arabia
Tell us which systems and which framework you need to satisfy. We will scope the test against NCA ECC, CCC, OTCC or SAMA CSF and send a fixed-price proposal in SAR within 24 hours.
Learn More About Pentesting in Saudi Arabia
Guides on NCA and SAMA testing requirements, OT security and red teaming
