Penetration testing in Saudi ArabiaFind the gap before someone else does.
Penetration testing and compliance readiness for Saudi organisations.
Free first step. We reply within one business day. No commitment.
- 30 min
- call to scope your review
- 108
- main controls in NCA ECC-2:2024Source: NCA, ECC-2:2024 (opens in a new tab)
Free first step
Security Posture Review
- You give:
- A 30-minute call and the list of systems in scope
- You get:
- A short written view of where you are most exposed, what we would test first and which compliance gaps to close first. Usually within a week of the call.
The problem
TQN delivers penetration testing in Saudi Arabia for web, mobile, API and network estates, carried out by our own testers. We find what an attacker could reach, prove it with evidence, rank it by business impact and stay until it is fixed. The same team maps your controls against NCA ECC, PDPL and SAMA frameworks, so security work and audit work point the same way.
- 01
Your last penetration test is a PDF nobody has reopened.
- 02
Every release changes the attack surface. An annual test does not keep up.
- 03
Auditors ask for evidence of controls you believe exist but cannot show.
What TQN delivers
Penetration testing and vulnerability assessment, end to end
- 01
Web application testing
Find the flaws that expose customer data or money. We test authentication, access control, business logic and injection by hand, the way an attacker would.
- 02
Mobile application testing
Know what your app gives away on a lost or tampered phone. We test the app, its local storage and every API it calls.
- 03
API testing
Close the endpoints that return someone else's records. We test authorisation object by object, rate limits and data exposure across your APIs.
- 04
Network and infrastructure testing
See what can be reached from the internet and from inside. External and internal testing of servers, services, segmentation and exposed admin interfaces.
- 05
Vulnerability assessment
A ranked list of known weaknesses across your estate, with false positives removed before you see it. Scheduled scans, each result verified by a tester.
- 06
Security testing in your release pipeline
Catch vulnerabilities before release, not after. Application security testing runs inside your CI/CD pipeline, with pass and fail thresholds your team agrees.
- 07
Cloud configuration review
Find the open storage, broad permissions and exposed keys. We review identity, network and storage settings against secure baselines.
- 08
NCA ECC and PDPL compliance readiness
Walk into the assessment with evidence. We map your controls to the NCA ECC, PDPL or SAMA framework that applies, show the gaps and plan the work to close them.
Free first step. Fixed scope after. You decide at each stage.
How it works
From first scan to NCA ECC readiness: how we work
- 1
Assess, free
The Security Posture Review: a 30-minute call and your list of systems. You get back the testing and compliance priorities.
- 2
Scope a first engagement
A fixed-scope test on the systems that matter most, with rules of engagement, test windows and success measures agreed in writing.
- 3
Test and report
Every finding comes with severity, evidence, business impact and the fix. Critical findings reach you the day we confirm them, not at the end.
- 4
Fix and retest
Your developers get remediation guidance they can act on. We retest each fix and close the finding only when the fix holds.
- 5
Run and improve
Testing moves into your release pipeline and onto a schedule, and your compliance evidence stays current between assessments.
- CriticalIDOR on invoice APIBilling APIFix in progress
- HighStored XSS in support chatCustomer portalRetest passed
- MediumPublic storage bucketCloud tenantAwaiting retest
- MediumTLS 1.0 still enabledVPN gatewayOpen
- LowVerbose error messagesMobile app APIRisk accepted
Before you ask
Five answers before the first call.
- 01What do I get?
- A tested, ranked list of what an attacker could reach in your systems, with evidence, business impact and the fix for each finding. Where a framework applies, a map of your controls against NCA ECC, PDPL or SAMA requirements.
- 02How fast?
- Scope sets the duration, and we commit to it in writing before we start. The work runs in phases: scoping, active testing, reporting, then retesting once fixes land. Critical findings reach you as soon as they are confirmed. The measure that matters is time from confirmed finding to verified fix.
- 03What does it need from me?
- A signed scope and written authorisation, test accounts for each user role, one technical contact, and agreed test windows for production systems. For compliance readiness, your current policies and time with the people who own each control.
- 04Where does my data go?
- Test evidence and reports are held on your premises, in a Saudi data centre, or wherever you choose inside the Kingdom. We keep only what the report needs and delete it on the schedule set in the contract.
- 05What does it cost to start?
- The Security Posture Review is free. The first engagement is fixed scope and priced before it starts, with the retest written into that scope.
Still have a question? Add it to your request. We reply within one business day.
Use cases by industry
Penetration testing for regulated sectors: NCA ECC and PDPL compliance
- Banking and financial services
Payment and lending platforms
Prove one customer cannot reach another's account before a SAMA review. We test mobile apps, APIs and payment flows, then map the results to the SAMA framework.
View industry - Government and smart cities
Government-adjacent entities preparing for NCA ECC
Know which Essential Cybersecurity Controls you meet today and which need work. Gap assessment, testing evidence and a remediation plan in one engagement.
View industry - Healthcare
Patient portals and health records
Keep patient data out of reach. We test portals, booking apps and the integrations that carry health data, and check data handling against PDPL.
View industry - Software and technology companies
SaaS teams releasing every sprint
Ship every week without reopening old vulnerabilities. Security tests run in your pipeline and stop any release that breaks the agreed thresholds.
View industry - Retail and malls
E-commerce and loyalty apps
Stop account takeover and voucher abuse. We test login, checkout and loyalty logic the way fraudsters probe them.
View industry
Industries we serve
Assessment and pilot
What the free assessment covers. What the pilot report contains.
The free assessment covers: Security Posture Review
- Your internet-facing systems and what they are likely to expose
- Which frameworks apply to you: NCA ECC, PDPL, SAMA
- When each system was last tested, and how
- The systems to test first, ranked by business risk
- A proposed scope for a fixed first engagement
The pilot report contains
- An executive summary of risk in business terms
- Each finding with severity, evidence and steps to reproduce
- Remediation guidance your developers can act on
- Findings mapped to the controls that apply to you
- Retest results showing which fixes hold
Data, privacy and compliance
Your data stays where you decide.
- Every test runs under a signed scope and written authorisation; nothing outside scope is touched.
- Test evidence and reports stay inside the Kingdom, on your premises or in a Saudi data centre.
- Where testing reaches personal data, we capture only what proves the finding, masked.
- Our process is designed to support PDPL and NCA requirements, and readiness work follows NCA ECC, PDPL and SAMA frameworks directly.
- We do not certify compliance. We prepare you and your evidence for the assessment.
FAQ
Questions buyers ask us.
No surprises. Production systems are tested in agreed windows, and tests that could affect service are excluded unless you approve them. Pipeline security testing plugs into your existing CI/CD with thresholds your team sets, and runs in report-only mode before it blocks any release.
Nowhere outside the Kingdom. Reports and evidence are held on your premises or in a Saudi data centre, at your choice. Only the named testers on your engagement can access them, and they are deleted on the agreed schedule.
It depends on scope: the number of applications, user roles, APIs and network ranges. We fix the duration in writing before we start. Critical findings come to you as soon as they are confirmed, so you are not waiting on the final report to act.
A technical contact, test accounts for each user role and access to the environments in scope. During testing, a few short check-ins. After the report, your developers fix; we walk them through each finding and retest.
You fix, we retest, and every finding closes with evidence. Then you choose: scheduled testing, security testing in your pipeline, compliance readiness, or none of these. The first engagement commits you to nothing beyond its scope.
Each engagement has a fixed scope, a written statement of work and agreed rules of engagement. Ongoing work runs as a retained service with a testing calendar, retests and a named lead. One TQN team stays accountable from scope to retest.
Other practices
Five practices, built to run in production in Riyadh.
- 01
Vision AI
Live counts, alerts and evidence from the cameras you already own.
View practice - 03
Quality Engineering
Tests that write, run and repair themselves, so every release ships on time.
View practice - 04
AI Agents
Agents that answer, process and report in Arabic and English, inside your rules.
View practice - 05
ERP and PMO
Cost, procurement and schedule in one view, so overruns show while you can act.
View practice
Start here
Start with one problem. We will show you the result.
Tell us the problem in one line. We reply within one business day with the free first step that fits it.
Already have systems? We test the systems you run today, in agreed windows, with no surprises in production.
Need proof first? The first step is free, and pilot targets are agreed in writing before work starts.
Concerned about data? Reports and evidence stay on your premises or in a Saudi data centre, and are deleted on the agreed schedule.
Is Arabic a must? We work, report and deliver in Arabic and English.