Author · Sumrite
Faisal Khan, Director at Sumrite.
Faisal Khan is the founder and Director of Sumrite, the penetration testing and security compliance company he started in New Delhi in May 2007.
RoleDirector
Articles52
Based inNew Delhi, India
About Faisal Khan
Faisal Khan is the founder and Director of Sumrite, the penetration testing and security compliance company he started in New Delhi in May 2007. He oversees Sumrite’s penetration testing, risk assessment and compliance engagements for SaaS, fintech and enterprise clients in India, the Gulf, Europe and Australia, and writes on VAPT, CERT-In audits, the DPDP Act and Saudi NCA requirements.
- Role
- Director, Sumrite
- Company
- Sumrite, New Delhi (legal name Summit Printrite Private Limited)
- linkedin.com/in/faisal-sumrite
- faisal@sumrite.com
- Focus
- Penetration testing and VAPT reporting; CERT-In audits and Indian regulatory testing (RBI, SEBI CSCRF, DPDP); Saudi NCA, SAMA and PDPL engagements; SOC 2 and ISO 27001 evidence
Articles by Faisal Khan (52)
ComplianceHow to Run an NCA ECC Gap Assessment, Step by Step A practical method from Sumrite.A step-by-step method for an NCA ECC-2:2024 gap assessment: scoping, scoring 108 main controls, evidence NCA expects, and turning gaps into a remediation roadmap.VAPT GuidesHow Much Does Penetration Testing Cost in Saudi Arabia? What Drives the Price Scope drivers explained by Sumrite.Why there is no honest price list for penetration testing in Saudi Arabia, the nine scope drivers that set the quote, and how to brief vendors so quotes compare like for like.ComplianceSelling SaaS into Saudi Arabia? The Security Requirements Your Buyers Will Ask For A vendor's guide from Sumrite.What Saudi buyers ask foreign SaaS vendors for: ECC 4-1 contract clauses, CCC cloud controls, PDPL processor duties and pentest evidence, and how to prepare.ComplianceNCA ECC Compliance in 2026: The Complete Guide to ECC-2:2024 The NCA pillar guide from Sumrite.Who must comply with NCA ECC-2:2024, how its 4 domains, 28 subdomains and 108 main controls fit together, how NCA assesses compliance, and where to start.ComplianceNCA ECC-2:2024 Compliance Checklist: 108 Controls Across 4 Domains A domain-by-domain checklist from Sumrite.A domain-by-domain NCA ECC-2:2024 checklist covering all 28 subdomains and 108 main controls, with the evidence that proves each item to an assessor.ComplianceSaudi PDPL vs GDPR: Key Differences for International Companies A side-by-side comparison from Sumrite.Built a GDPR programme and now selling into Saudi Arabia? Where the Saudi PDPL matches the GDPR, where it differs, and the gaps European companies usually miss.VAPT GuidesWeb Application Penetration Testing in Saudi Arabia: Scope, Method and Compliance A practical guide from Sumrite.What a web application penetration test in Saudi Arabia should cover, which OWASP method to follow, and how the results map to NCA ECC 2-11, ECC 2-15 and SAMA CSF 3.2.4.VAPT GuidesMobile App and API Penetration Testing for Saudi Fintechs and Apps What SAMA expects, explained by Sumrite.How Saudi fintechs and app companies should scope mobile app and API penetration tests against SAMA CSF, SAMA CRFR, the Open Banking Framework and NCA ECC 2-11.ComplianceSDAIA National Register of Controllers: Who Must Register and How A practical walkthrough from Sumrite.Who must register with SDAIA under the PDPL, how registration works on the National Data Governance Platform, what to prepare, and what the October 2026 draft would change.ComplianceNCA ECC vs SAMA CSF: Dual Compliance for Saudi Financial Institutions A dual-compliance playbook from Sumrite.When a Saudi financial institution answers to both NCA and SAMA: scope, a domain mapping, the differences that matter and one pentest programme for both.CompliancePDPL Compliance Checklist for Saudi Businesses (2026) A practical working list from Sumrite.A working PDPL compliance checklist for Saudi businesses: every core obligation, the article behind it and the evidence to keep, in the order we implement it.VAPT GuidesSAMA Ethical Red Teaming vs Penetration Testing: What Saudi Financial Entities Need Explained by Sumrite.SAMA's FEER framework says red teaming is not a penetration test. Here is how the two differ, how often each is due, and how to prepare for a FEER exercise.ComplianceSaudi PDPL Compliance Guide 2026: Enforcement Is Now Live What the law requires, explained by Sumrite.Saudi Arabia's PDPL is fully enforceable and SDAIA is issuing penalties. Who it covers, what it requires, what enforcement looks like and how to build a defensible programme.ComplianceECC-2 Control 1-2-2: Staffing Cybersecurity Roles with Saudi Professionals What it requires, explained by Sumrite.ECC-2:2024 control 1-2-2 requires all cybersecurity positions to be filled by full-time, qualified Saudi professionals. What changed, who it covers and how to evidence it.ComplianceSAMA Cyber Security Framework: Domains, Maturity Levels and Compliance Steps The SAMA CSF guide from Sumrite.What the SAMA Cyber Security Framework covers, who must comply, its four domains and six maturity levels, why level 3 is the floor, and how to get there.ComplianceECC-1:2018 vs ECC-2:2024: What Changed and What It Means for You Every change, checked by Sumrite.What NCA changed between ECC-1:2018 and ECC-2:2024, from the control count and the ICS domain to hosting, Saudization, MFA and DDoS, and what to update.Threat ResearchCost of a Data Breach in Saudi Arabia 2026: SAR 27 Million per Breach IBM's 2026 numbers, explained by Sumrite.IBM puts the average Saudi data breach at SAR 27 million in 2026. Which industries and attack vectors cost most, why speed matters, and how to test before attackers do.Threat ResearchCyber Threats Facing Saudi Businesses in 2026 and How to Test Your Defences Threat data, explained by Sumrite.Who is attacking Saudi organisations in 2026, which sectors are hit, how attackers get in, what a breach costs, and how to test whether your defences would hold.VAPT GuidesPenetration Testing in Riyadh: What Riyadh Businesses Need to Know A local briefing from Sumrite.Riyadh hosts NCA, SAMA and CST. What that means for penetration testing in Riyadh: who must test, what to scope, and how to plan around local delivery constraints.ComplianceCERT-In AMBAK explained What Sumrite can confirm, and what is still a claim.AMBAK is CERT-In's new platform for monitoring and benchmarking security audits. What is officially confirmed, which viral claims are not, and what auditees should do.VAPT GuidesPTaaS in Saudi Arabia: Why Continuous Pentesting Fits ECC-2 Better Than Annual Tests How it maps to NCA controls, by Sumrite.Why continuous pentesting (PTaaS) matches ECC-2:2024's periodic testing and change-driven controls better than a single annual test, with a control-by-control mapping.VAPT GuidesPenetration Testing in Saudi Arabia: An NCA ECC & SAMA-Aligned Guide (2026) The pillar guide from Sumrite.Which Saudi rules require penetration testing, how each test type maps to NCA ECC 2-11 and SAMA CSF 3.2.4, how often to test, and what evidence reviewers ask for.Security HardeningThe absence of RBAC and broken access control What Sumrite finds when every user can do everything.No role-based access control means the only thing stopping a user from reaching admin functions is that they have not tried the URL yet. Why it is critical and how to find it.VAPT GuidesWhat makes a VAPT report actually worth paying for and what a scanner report looks like, from SumriteA scanner report lists missing headers. A VAPT report proves impact. Learn how to tell them apart before you pay, and what you can get free.VAPT GuidesMobile app penetration testing checklist Sumrite's checklist, mapped to OWASP MASVS.What to test in an Android or iOS app, mapped to the eight OWASP MASVS control groups, plus how to scope a mobile pentest and what a useful report includes.ComplianceNCA CCC-2:2024 Cloud Cybersecurity Controls: A Guide for Providers and Tenants CSP and CST duties, explained by Sumrite.How NCA's Cloud Cybersecurity Controls (CCC-2:2024) split duties between cloud providers and tenants, how data levels change scope, and what testing they require.VAPT GuidesThe ultimate web application VAPT guide for SaaS companies, by Sumrite.What a SaaS company needs from web application VAPT: scope, OWASP coverage, a scorecard for choosing a provider, deliverables, and how Sumrite runs it.VAPT GuidesHow often should you run a penetration test? Sumrite on why annual is the floor, not the plan.Most teams test once a year. Regulators often expect more, and every major release resets the clock. A framework-by-framework guide to pentest frequency.VAPT GuidesVAPT for SaaS startups: what to test before enterprise deals and when to do it, from SumriteEnterprise buyers ask for a recent penetration test. Here is what SaaS startups should test, when, and what the report needs to show.ComplianceCERT-In empanelled auditors and VAPT What is actually required, explained by Sumrite.Who actually requires a CERT-In empanelled auditor, what empanelment means, what the audit report must show and how to check a provider before you sign.
Other authors
Want an expert to look at your application?
Fixed-scope quote, expert-led testing, retest included.