ياء التساهيل
AR Request a Quote
Services

Offensive security and secure software, under one roof

From testing what you’ve built to building it securely from day one.

01Web & API Penetration Testing

Your app, tested the way an attacker would.

Manual, in-depth testing of web applications and APIs against OWASP Top 10 and OWASP API Security Top 10, going beyond automated scanners into real attack paths.

Includes
  • Authentication & session management
  • Access control & privilege escalation
  • Business logic flaws
  • Injection (SQLi, XSS, SSRF, etc.)
  • REST & GraphQL APIs
You get

Executive + technical report, CVSS ratings, remediation guidance, free retest

02Mobile App Penetration Testing

Mobile apps, secured inside and out.

Android and iOS testing aligned with OWASP MASVS and MASTG, covering the app, its traffic, and the backend APIs it talks to.

Includes
  • Insecure local storage
  • Traffic interception & certificate pinning
  • Reverse engineering & hardcoded secrets
  • Backend API testing
You get

Report mapped to MASVS, remediation guidance, free retest

03GRC, Gap & Risk Assessment

Know exactly where you stand with NCA.

A structured gap and risk assessment against NCA Essential Cybersecurity Controls (ECC), Cloud Cybersecurity Controls (CCC), and PDPL requirements, with governance support and a clear roadmap to close each gap.

Includes
  • Cybersecurity risk assessment
  • Control-by-control assessment
  • Gap register with priorities
  • Remediation roadmap
  • Policy and procedure support
  • Audit evidence preparation
You get

Gap assessment report + prioritized action plan

04Cyber Threat Intelligence

Know who’s targeting you before they strike.

Actionable threat intelligence tailored to your organization: monitoring for leaked credentials, dark web mentions, brand impersonation, and emerging threats relevant to your sector in Saudi Arabia.

Includes
  • Dark web & data leak monitoring
  • Brand impersonation & phishing domain detection
  • Threat actor & campaign profiling
  • Digital exposure & attack surface review (OSINT)
  • Sector-specific threat briefings
You get

Threat intelligence report + periodic alerts with recommended actions

05Secure Web Development

Websites and web apps, secure by design.

Business websites, landing pages, dashboards, and internal web apps, built with security baked in from the first line of code. Also: secure code review for existing applications.

Includes
  • Bilingual (AR/EN) responsive websites
  • Custom web apps & dashboards
  • Secure headers, input validation, access control
  • Secure code review
You get

Delivered source code, documentation, security checklist

06Automation & Custom Tools

Hours of manual work, done in seconds.

Python scripts and custom tools that remove repetitive work: data extraction and export, automated reports, API integrations, and workflow automation.

Includes
  • Data scraping & export (Excel/CSV)
  • Report generation
  • System integrations via API
  • Scheduled automations
You get

Working tool + source code + usage guide

How we work

Four clear steps from first call to close-out

01

Scoping & authorization

A free call to define scope, then a signed testing authorization.

02

Testing or building

Work runs to an agreed timeline, with immediate alerts for critical findings.

03

Report & walkthrough

The report is delivered and walked through with your technical and management teams.

04

Retest & support

After remediation, we verify every fix and close out the engagement.

FAQ

Questions we hear often

Is penetration testing legal?

Yes, only with written authorization from the system owner. Every engagement starts with a signed scope and rules of engagement.

Will testing affect my live system?

Testing is controlled and non-destructive by default. We can also test on a staging environment.

How long does it take?

It depends on scope. A typical web application takes 5 to 10 working days. You get an exact timeline after the scoping call.

How is pricing set?

By scope (number of applications, user roles, endpoints). You receive a fixed quote before work starts, with no surprises.

Do you work outside Jeddah?

Yes. We work remotely with clients across Saudi Arabia and the GCC.

Have a system you want tested or built?

Tell us what you have and we’ll come back with a clear scope and a fixed quote.

Request a quote →