Penetration testing for banks and fintechs in Saudi ArabiaEvery release is a new attack surface.
Security testing, compliance readiness and release quality for banks, insurers, finance companies and fintechs in the Kingdom.
Free first step. We reply within one business day. No commitment.
- 30 min
- call to scope your review
- 108
- main controls in NCA ECC-2:2024Source: NCA, ECC-2:2024 (opens in a new tab)
Free first step · Cybersecurity
Security Posture Review
- You give:
- A 30-minute call and the list of systems in scope
- You get:
- A short written view of where you are most exposed, what we would test first and which compliance gaps to close first. Usually within a week of the call.
Scenarios
Where we start.
TQN provides penetration testing for banks and fintechs in Riyadh and Jeddah, across web, mobile, API and network layers, and retests after every fix. We prepare security and compliance teams for SAMA Cyber Security Framework assessments, load-test platforms before peak days, and build Arabic AI agents with a human approval step wherever money or customer data moves.
- 01Cybersecurity
Penetration testing on every channel
Security leads know which exploitable flaws sit in the mobile app, open APIs and internet banking before an attacker finds them. We test authentication, session handling, payment flows and API authorisation, rate each finding by severity with proof and a fix, and retest after remediation so the closing report reflects the current state.
- 02Cybersecurity
Ready for the SAMA framework assessment
Compliance and security teams go into the maturity assessment with a gap register mapped to the SAMA Cyber Security Framework and the evidence behind each control. We review policies, configurations and cloud setups, prioritise the gaps, and track remediation to closure, with NCA controls mapped where they also apply.
- 03Quality Engineering
Releases that hold on salary day
Mobile banking and payment releases ship on schedule and stay up under peak load. Test agents generate regression cases from user stories and API documentation, run them in your CI/CD pipeline, repair themselves when screens change, and load tests rehearse salary-day and seasonal peaks before they arrive.
- 04AI Agents
Customer enquiries in Arabic, with approval where money moves
Customers get answers on card status, transfers and required documents at any hour, and nothing that moves funds happens without a person. The agent reads from your systems through approved interfaces, handles routine requests end to end, and pauses for staff approval on disputes, limit changes and any action that touches an account.
Free first step. Fixed scope after. You decide at each stage.
In practice
Penetration testing on every channel
Security leads know which exploitable flaws sit in the mobile app, open APIs and internet banking before an attacker finds them.
- CriticalIDOR on account lookupAPI /accounts/{id}Retest passed
- HighOTP brute force possibleLogin APIIn remediation
- HighWeak certificate pinningMobile appOpen
- MediumVerbose error messagesInternet bankingOpen
- LowMissing security headersPublic websiteRisk accepted
Regulations and national programmes
The rules that shape the work.
SAMA Cyber Security Framework
Issued by the Saudi Central Bank in 2017, the framework applies to member organisations regulated by SAMA, including banks, insurance companies, finance companies and credit bureaus. SAMA uses it to assess the cyber security maturity of those organisations periodically.
Official sourcePersonal Data Protection Law (PDPL)
Overseen by SDAIA, the PDPL governs how customer personal data is collected, used, kept and transferred outside the Kingdom, with implementing regulations and a separate regulation on transfers abroad. Our agents and test environments are designed to support PDPL and NCA requirements.
Official sourceFinancial Sector Development Program
A Vision 2030 realisation programme to develop a diversified and stable financial sector across banking, insurance and capital markets, including the growth of fintech.
Official source
Summaries for orientation only. Read the official source for the full requirement.
We map the requirement to your systems in the free first step.
Practices for this sector
The practices that fit.
- 02
Cybersecurity
Find and fix the gaps an attacker could use, before an attacker or auditor does.
First step: Security Posture Review
View practice - 03
Quality Engineering
Tests that write, run and repair themselves, so every release ships on time.
First step: QA Readiness Review
View practice - 04
AI Agents
Agents that answer, process and report in Arabic and English, inside your rules.
First step: Agent Opportunity Workshop
View practice
FAQ
Questions from this sector.
Yes. We agree rules of engagement in writing first: which environments, which windows, which accounts, and what is out of bounds. Destructive tests run only in staging or with explicit approval, and a named contact on your side can stop testing at any point.
We map findings to the SAMA Cyber Security Framework domains so your team can use them as evidence in self-assessment and audit. The assessment itself is SAMA's. We do not certify anyone or speak for the regulator.
Findings and evidence stay inside the Kingdom, are restricted to the named testers on your engagement, and are deleted on an agreed schedule. Test environments use masked or synthetic data wherever possible. All of it is designed to support PDPL and NCA requirements.
Only through the interfaces your architecture and security teams approve, and read-only first. Any action that changes an account goes through a human approval step, and every agent action is logged and evaluated in production.
It depends on the number of applications, APIs and network segments in scope. The free Security Posture Review sizes it, and the scope, timeline and price are fixed in writing before testing starts.
The options are application security testing inside the release pipeline, scheduled retests before major releases, or both, under a support contract with a named team. You choose the cadence after seeing the first report.
Insights
Related insights
Start here
Start with one problem. We will show you the result.
Tell us the problem in one line. We reply within one business day with the free first step that fits it.
Already have systems? We start from the cameras, applications and systems you run today.
Need proof first? The first step is free, and pilot targets are agreed in writing before work starts.
Concerned about data? Data stays in the Kingdom, on your premises or in a Saudi data centre, agreed in writing during the assessment.
Is Arabic a must? We work, report and deliver in Arabic and English.