Most SAMA compliance failures are not technical. They happen because governance is undocumented, evidence is incomplete, or institutions discover during supervisory review that controls they believed were at Level 3 cannot be demonstrated to a regulator's standard. This SAMA compliance checklist is designed for CISOs, compliance managers, and
The most common question we get before a scoping call is some version of: "just tell me what a penetration test costs." The honest answer is that it depends on what you're testing and how deeply but the ranges are predictable, the variables are well-understood, and
Most financial institutions in Saudi Arabia know they need to comply with SAMA. Fewer understand what compliance actually requires, how maturity is measured, how long it takes, and critically how it differs from other frameworks like ISO 27001 or NESA. This guide answers those questions directly. It covers what the
The question comes up constantly when a CISO has done several rounds of penetration testing and starts wondering whether they're getting diminishing returns. The answer is that penetration testing and red teaming are not competing services they measure different things, serve different purposes, and the data on when
As NESA assessments and regulatory reviews approach, organizations often realize that compliance gaps are rarely technical alone. More often, challenges stem from unclear governance, incomplete evidence, or misaligned risk management practices. This NESA compliance checklist is designed as a readiness guide for CISOs, compliance managers, and risk leaders who are
Two things are happening simultaneously in 2026v organisations are deploying AI features faster than their governance can keep up, and regulators are finalising enforcement frameworks that carry penalties measured in millions of euros. The EU AI Act became fully enforceable for most operators on 2 August 2026. Finland activated the
Network penetration testing is the oldest category in offensive security and the one most frequently misscoped, mislabelled, or substituted with something cheaper that doesn't actually satisfy what an auditor or security programme needs. If you're preparing for a SOC 2 or ISO 27001 audit, evaluating whether
Most organisations that have pentested their web application haven't pentested their cloud environment. The two share an attack surface at the edges SSRF, exposed storage, misconfigured APIs but cloud infrastructure has vulnerabilities that a web app pentest scope doesn't touch: IAM privilege escalation, metadata service exploitation,
ISO 27001 doesn't spell out "conduct a penetration test." What it does require is a structured programme of security evaluation that, in practice, auditors universally expect a pentest to satisfy. If your certification audit is approaching and you're uncertain whether a vulnerability scan is
Most security teams assume their mobile app was covered in the web app pentest. It wasn't. The API calls, yes. The backend logic, partially. But the binary sitting on your users' devices the local storage, the hardcoded secrets, the certificate pinning that a tester bypasses in 60
The Netherlands, a hub of innovative SaaS startups, is experiencing a rapid rise in digital threats. According to the Dutch Data Protection Authority, there were 37,839 data breach notifications in 2024, with cybercrime-related incidents climbing sharply. Across Europe, more than 130,000 breaches were reported, and the Netherlands alone
APIs are where modern applications actually live and where most of the significant security vulnerabilities are found. A web application pentest that doesn't explicitly include your API surface isn't testing the majority of your attack surface. It's testing the interface in front of it.