E / 05 Service line

Cybersecurity, built for the Kingdom.

Zero-trust architecture aligned to NCA ECC and SAMA CSF, NDMO-classified data protection, and a 24×7 sovereign SOC. Threat detection that speaks Arabic and reports to the right regulator the first time.

NCA-alignedECC · CCC · TCC
SOC sovereign24×7 in-kingdom
SAMA CSFbanking-grade
SCHEMATIC · ZERO-TRUST
v1.0
CROWN JEWEL CLASSIFIED · NDMO IDENTITY · MFA · PAM NETWORK · SEGMENTATION PERIMETER · WAF · DDoS EXTERNAL PHISH INSIDER SIEM SENTINEL XDR CROWDSTRIKE SOAR PALO XSOAR SOC 24/7 RIYADH
» defence in depth · zero-trust by default
» NDMO-classified perimeter
» sovereign SOC · in-kingdom analysts
01 / Capabilities

What we deliver under Cybersecurity.

Strategy, architecture, operations — and the unglamorous compliance plumbing in between.

CAP / 01

NCA ECC / CCC / TCC

Gap assessments, control implementation, and audit readiness for the National Cybersecurity Authority's frameworks. We've taken organizations from "behind" to "audited and clean".

ECCCCCTCC
CAP / 02

SAMA CSF

Banking-grade cybersecurity for SAMA-regulated entities. Maturity uplift, third-party risk, and the regulator submissions that keep the license valid.

SAMA CSF3PRSubmissions
CAP / 03

Zero-trust architecture

Identity-first network design, micro-segmentation, and policy enforcement at every layer. Adapted to NDMO data classification — public to top secret.

ZTNAMicro-segNDMO
CAP / 04

Managed SOC

24×7 sovereign SOC operating from Riyadh. SIEM, XDR, SOAR, and threat intel tuned to Saudi-context threats — including Arabic phishing and regional adversary TTPs.

24×7SovereignArabic-aware
CAP / 05

Incident response

IR retainer with hourly response. Forensics, containment, eradication, and the regulator and SAMA notifications that need to be made within hours, not days.

1-hr SLAForensicsNotifications
CAP / 06

Offensive security

Red-team, purple-team, and continuous attack-surface monitoring. Adversary simulation that mirrors real Saudi-targeting groups, not generic kill-chain demos.

Red-teamPurple-teamASM
02 / Technology

The stack we operate.

Best-of-breed, vendor-honest. The right tool for the regulator, the threat, and the cost ceiling.

SIEM
Sentinel
SIEM
Splunk
XDR
CrowdStrike
XDR
Defender
SOAR
XSOAR
NETWORK
Palo Alto
NETWORK
Fortinet
IDENTITY
Entra ID
PAM
CyberArk
DLP
Forcepoint
SCANNING
Tenable
CASB
Netskope
03 / Methodology

How we engage on Cybersecurity.

PHASE / 01

Maturity assessment

Map current state against NCA ECC, SAMA CSF, ISO 27001, or whatever frameworks apply. Output: a gap register and a prioritized remediation roadmap.

3–4 weeksfixed scope
PHASE / 02

Architecture & remediation

Zero-trust design, control implementation, identity hardening. Delivered against the gap register from phase 01 with measurable closure rates.

3–6 monthsmilestone-based
PHASE / 03

SOC onboarding

Telemetry sources connected, use cases tuned, playbooks documented. Three months of co-managed before fully managed transition.

3 monthsonboarding
PHASE / 04

Managed SOC + IR retainer

24×7 monitoring, incident response with 1-hour SLA, monthly threat briefings, and quarterly purple-team exercises. SLA-backed.

OngoingSLA retainer
04 / Compliance

The frameworks we live in.

Saudi-first, with international standards layered for export-ready engagements.

NCA ECC
NCA CCC
NCA TCC
SAMA CSF
PDPL
NDMO Classification
ISO 27001
ISO 22301
SOC 2
PCI-DSS
NIST CSF
MITRE ATT&CK
05 / Sector application

Where security is non-negotiable.

06 / FAQ

Common questions.

Where is your SOC located?

In-kingdom, Riyadh. All analysts cleared to handle classified data per NDMO. We do not offshore tier-1 monitoring or incident handling — sovereignty is the point.

How do you stay current on local threats?

We run our own threat intel function focused on regional adversary groups. Arabic phishing, sector-targeted campaigns, and Saudi-specific TTPs are tracked in our own corpus, not just Mandiant or Recorded Future feeds.

What's the IR SLA?

One hour to a senior responder during a P1 incident. Containment within four hours for known TTPs. Forensics and regulator notifications handled by our compliance team in parallel.

Can you handle SAMA submissions?

Yes. We've drafted, defended, and revised SAMA self-assessments and remediation plans. Our compliance team includes ex-regulator practitioners.

Do you do red-team exercises?

Yes. Real-world adversary simulation — credentialed access, Arabic phishing, physical, and OT where in scope. Reports written to NCA's standards.

How do you measure SOC quality?

Mean time to detect, mean time to respond, false positive rate, and analyst-tuned use-case coverage — all reported monthly. Use-case library is co-owned, never proprietary.

Security with local depth.

أمن سيبراني بعمق محلي.

Thirty-minute working session with our Cybersecurity lead. We'll triangulate your current posture against NCA / SAMA / PDPL and give you the three things to fix this quarter.