Cybersecurity talent — recruitment and outsourcing
We find, assess and place cybersecurity people for you — permanent hires, or specialists on our payroll working on your team.
Learn MoreServices
Cybersecurity advisory built for Saudi regulation
Governance, risk, compliance and security leadership services aligned to SAMA, NCA and SDAIA requirements — scoped to your institution and delivered with evidence.
Penetration Testing
Advanced adversarial testing to identify vulnerabilities before threat actors do, aligned to SAMA requirements.
Learn MorePolicies, Standards & Procedures
We develop or update your cybersecurity policies, standards and procedures, mapped to the frameworks you must meet and written in Arabic and English.
Learn MoreCyber Risk Management
We establish or mature your cyber risk management: methodology, appetite, assessment, treatment and reporting — integrated with your enterprise risk framework.
Learn MoreVulnerability Management Program
We run or mature your vulnerability management: scanning coverage, risk-based prioritization, remediation tracking against agreed timelines, and reporting.
Learn MoreSWIFT CSCF Assessment & Attestation
We independently assess your SWIFT environment against the current Customer Security Controls Framework, identify gaps and support remediation and your annual attestation.
Learn MorePCI DSS Readiness & Compliance
We prepare you for PCI DSS v4.0: scoping and segmentation, gap assessment, remediation support and readiness for your QSA assessment or self-assessment questionnaire.
Learn MoreISO/IEC 27001 ISMS Implementation
We implement your ISO/IEC 27001:2022 ISMS: scope, risk assessment, Statement of Applicability, policies, internal audit and management review — ready for certification.
Learn More
Fraud Management Solution
Vendor-independent selection and implementation of a fraud management system: requirements, vendor evaluation, rules and models, integration and go-live.
Learn More
SAMA Counter-Fraud Framework Implementation
We design and implement the governance, policies, roles, processes and reporting your institution needs to meet the SAMA Counter-Fraud Framework.
Learn More
Fraud Detection and Transaction Monitoring Optimization
Review and tune the rules, scores and workflows of your fraud monitoring system across cards, mada, SARIE, instant payments and digital channels.
Learn More
Digital Banking and Payment Fraud Controls Review
An end-to-end review of fraud controls in mobile and internet banking, eKYC onboarding (Nafath), device binding, transaction signing and customer notifications.
Learn More
AML Assessment
An independent assessment of your AML/CTF program against the SAMA rules and the FATF Recommendations: governance, risk assessment, KYC, monitoring, reporting and training.
Learn More
AML Compliance Solution
Vendor-independent selection and implementation of AML technology: customer risk scoring, sanctions screening, transaction monitoring and case management.
Learn More
AML Monitoring and Screening Model Validation
Independent validation of transaction monitoring scenarios and name-screening tools: data quality, thresholds, fuzzy-matching performance and coverage of your risk assessment.
Learn More
KYC, CDD and eKYC Program Review
Review of customer due diligence, enhanced due diligence, beneficial ownership, PEP handling and digital onboarding through Nafath against SAMA requirements.
Learn More
Sanctions Compliance Program
Design or review of your sanctions compliance program covering UN, local, OFAC and EU regimes: screening, trade and payment controls, escalation and reporting.
Learn More
Financial Crime Awareness Training
Role-based AML/CTF, sanctions and fraud training for the board, front line, operations and compliance teams, with completion evidence for regulators.
Learn More
Cyber Insurance Readiness Assessment
We assess your controls the way underwriters do, close the gaps that drive premiums and exclusions, and prepare the evidence before you go to market.
Learn More
Cyber Risk Quantification for Insurance
We estimate the financial impact of your most likely and most severe cyber scenarios, so limits, retentions and budgets rest on numbers the board can trust.
Learn MoreGet Started
Need a custom solution?
Talk to our team to discuss your specific requirements.
Framework explorer
SAMA
NCA
SDAIA
SAMA
SAMA
NCA
SWIFT
ISO/IEC
PCI SSC
NIST
What each framework asks of you — and what we deliver
Pick a framework to see who it applies to, what it covers and what an engagement produces.
Saudi regulation
International and industry
SAMA CSF
SAMA’s Cyber Security Framework for the institutions it regulates, assessed on a maturity scale.
Applies to
BanksInsurance companiesFinance companiesOther SAMA-regulated institutions
Main areas
Leadership and governanceRisk management and complianceOperations and technologyThird-party cyber security
What we deliver
- Maturity assessment against every control
- Gap analysis and remediation roadmap
- Policies, standards and procedures
- Evidence pack for SAMA reviews
Typical first engagement: 8–12 weeks
NCA ECC-2:2024
The Essential Cybersecurity Controls — the baseline the National Cybersecurity Authority sets for national entities.
Applies to
Government entitiesCompanies owning or operating critical infrastructureTheir service providers
Main areas
Cybersecurity governanceCybersecurity defenseCybersecurity resilienceThird-party and cloud cybersecurity
What we deliver
- Compliance assessment with evidence
- Remediation plan with owners and dates
- Policies and procedures set
- Support through the NCA self-assessment
Typical first engagement: 6–10 weeks
PDPL
The Personal Data Protection Law and its regulations, overseen by SDAIA.
Applies to
Any organization processing personal data in the KingdomIncluding processing outside the Kingdom about its residents
Main areas
Lawful basis and consentData-subject rightsSecurity and breach notificationTransfers outside the Kingdom
What we deliver
- Personal data inventory and mapping
- Privacy notice and records of processing
- Breach response procedure
- Staff awareness
Typical first engagement: 6–8 weeks
SAMA BCM
SAMA’s Business Continuity Management framework for keeping critical services running through disruption.
Applies to
BanksInsurance and finance companies regulated by SAMA
Main areas
Governance and policyBusiness impact analysisContinuity and recovery plansTesting and exercises
What we deliver
- Business impact analysis
- Continuity and disaster-recovery plans
- Exercise design and reports
- Gap assessment against the framework
Typical first engagement: 8–12 weeks
SAMA CRFR
SAMA's fundamental requirements for cyber resilience: the baseline capabilities regulated institutions are expected to have in place to withstand, respond to and recover from cyber incidents.
Applies to
Institutions regulated by SAMA, as set out in SAMA's circularsTheir critical third parties, where the requirements extend to them
Main areas
Cyber resilience governance and oversightIdentification of critical services and assetsProtection and detection capabilitiesIncident response and recoveryTesting, exercising and continuous improvement
What we deliver
- Gap assessment against the requirements
- Prioritized remediation roadmap
- Resilience policies, plans and playbooks
- Exercise program and evidence pack for SAMA
Typical first engagement: 6–10 weeks for the assessment
NCA CCC
The Cloud Cybersecurity Controls — NCA’s requirements for cloud service providers and the organizations that use them.
Applies to
Cloud service providersOrganizations using cloud services
Main areas
GovernanceDefenseResilienceThird-party
What we deliver
- Cloud control assessment
- Shared-responsibility mapping
- Configuration review
- Remediation roadmap
Typical first engagement: 4–8 weeks
SWIFT CSCF
The Customer Security Controls Framework behind SWIFT’s yearly attestation.
Applies to
Every institution connected to SWIFT
Main areas
Secure your environmentKnow and limit accessDetect and respond
What we deliver
- Independent assessment of the controls
- Architecture-type review
- Evidence for the attestation
- Remediation support
Typical first engagement: 3–6 weeks
ISO/IEC 27001:2022
The international standard for an information security management system (ISMS): how an organization sets, runs, measures and improves its information security, with certification by an accredited body.
Applies to
Main areas
PCI DSS v4.0
The security standard for any organization that stores, processes or transmits payment card data, maintained by the PCI Security Standards Council.
Applies to
Main areas
NIST CSF 2.0
A widely used framework for managing cybersecurity risk, organized around six functions: Govern, Identify, Protect, Detect, Respond and Recover.
Applies to
Main areas
Readiness self-check
How ready are you? Find out in two minutes
Answer a few questions for your framework. You get a score, your biggest gaps and — if you want it — a detailed assessment from our team.
Ready to talk about your compliance?
Tell us where you stand. We will show you the shortest path to what your regulator expects.