On this page
- How common are phishing attacks in Saudi Arabia in 2026?
- How is AI changing phishing attacks against Saudi organisations?
- Why is WhatsApp phishing a particular risk in Saudi Arabia?
- How can staff spot an AI-generated phishing message?
- What do NCA ECC controls require for phishing defence?
- How do you run a phishing simulation in Saudi Arabia?
- What should a phishing simulation report measure?
- How Sumrite helps
- Frequently asked questions
Spelling mistakes and odd grammar used to give phishing away. That tell is largely gone. Generative AI writes clean Arabic and English, copies an executive’s tone from public posts, and produces convincing voice and video.
This post covers what the sourced data says about phishing against Saudi organisations as of November 2026, how AI and WhatsApp change the picture, what NCA ECC expects, and how to test your own people. Every figure links to its publisher.
How common are phishing attacks in Saudi Arabia in 2026?
Social engineering, which includes phishing, was used in 30% of successful cyber attacks on Saudi organisations between Q2 2025 and Q1 2026, tied with DDoS, according to the Positive Technologies executive summary. Across the wider Middle East, social engineering appeared in 22% of attacks and was often the way malware got in.
Phishing also hurts more than most entry points once it succeeds. IBM’s 2026 Cost of a Data Breach findings for Saudi Arabia list phishing, including voice and SMS phishing, as one of the three most expensive initial attack vectors in the Kingdom.
| Phishing indicator | Figure | Source and period |
|---|---|---|
| Saudi attacks using social engineering | 30% | Positive Technologies, Q2 2025 to Q1 2026 |
| Middle East attacks using social engineering | 22% | Positive Technologies, Q2 2025 to Q1 2026 |
| Average cost of a phishing-led breach in Saudi Arabia | SAR 30.6 million | IBM, 2026 study |
| Malicious breaches in Saudi Arabia that were AI-enabled | 25% | IBM, 2026 study |
| Gulf phishing sites using HTTPS | 82.3% | SOCRadar Gulf Region Threat Landscape Report, August 2026 |
| Gulf phishing incidents aimed at finance, insurance and banking | Over 36% | SOCRadar, August 2026 |
The SOCRadar figure on HTTPS matters for awareness training. If 82.3% of phishing sites aimed at the Gulf use HTTPS, then “look for the padlock” is advice that no longer protects anyone. Volumes also move with events. Bitdefender reported in March 2026 that malicious email aimed at Gulf countries rose about 130% on average against pre-war levels, with lures posing as bank representatives (including one impersonating Saudi Awwal Bank), shipping notices and ministry or legal letters.
For the wider threat picture, see our overview of cyber attacks in Saudi Arabia in 2026.
How is AI changing phishing attacks against Saudi organisations?
AI removes the quality gap that used to make phishing easy to spot. Attackers now use generative AI to write fluent, personalised lures at scale, and deepfake video and voice to build trust before the request arrives.
The Positive Technologies Middle East report documents several examples:
- APT35, June 2025: an AI-driven phishing campaign using AI-generated messages delivered by email and WhatsApp.
- APT42, June 2025: fake Gmail login pages, fake Google Meet invitations and AI-generated phishing emails.
- RedKitten, Q1 2026: deepfake videos on social media used to build trust before delivering modular malware.
- A December 2025 campaign against industrial organisations that included Saudi Arabia, aimed at stealing industrial data and credentials.
Positive Technologies forecasts that use of generative AI against individuals will likely increase, and that “as Arabic AI models emerge, attackers will use them to launch highly realistic social engineering campaigns.” Arabic-language quality was once a natural filter for Saudi staff. That filter is weakening.
What AI-powered phishing looks like in practice
- Hyper-personalised email. The lure references a real project, a real supplier and the correct job title, gathered from LinkedIn and company announcements.
- Executive voice notes. A short voice message “from the CFO” asking for an urgent transfer. Cyble reported in June 2026 that threat actors are experimenting with AI-generated voice and video to impersonate senior Gulf executives during financial approvals.
- Fake meeting invitations. A calendar invite or video-call link that leads to a credential-harvesting page.
Why is WhatsApp phishing a particular risk in Saudi Arabia?
WhatsApp phishing is a risk in Saudi Arabia because WhatsApp is a normal business channel there, yet it sits outside the email controls security teams depend on. A message that appears to come from the CEO arrives on a personal phone, with no mail gateway, no link rewriting and no “external sender” banner.
Cyble’s June 2026 analysis of executive impersonation in Gulf firms describes attackers cloning or hijacking executive WhatsApp accounts to pressure finance and HR staff, alongside lookalike domains that spoof corporate email and portals for UAE and Saudi entities.
Saudi regulators have treated messaging apps as a risk channel. According to Asharq Al-Awsat’s March 2025 report, the Saudi Central Bank (SAMA) prohibited banks from using instant messaging apps such as WhatsApp to communicate with customers, citing security concerns, and directed them to chat tools inside their official apps and websites.
The NCA has also given the public a way to check links. Its Tahqaq service, launched in December 2025, lets users submit a suspicious link for checking through the Haseen portal or a unified WhatsApp number before opening it.
WhatsApp versus email phishing at a glance
| Factor | Email phishing | WhatsApp phishing |
|---|---|---|
| Corporate filtering | Mail gateway, sandboxing, link rewriting | Usually none on personal devices |
| Sender verification | SPF, DKIM, DMARC (ECC 2-4-3) | Display name and profile photo only |
| Typical pretext | Invoice, login reset, document share | Urgent executive request, bank or government notice |
| Visibility to the SOC | Logged and searchable | Rarely visible |
| Best control | Filtering plus trained reporting | Out-of-band verification and payment approval rules |
How can staff spot an AI-generated phishing message?
Staff should judge the request, not the writing. AI-generated phishing is well written, so the reliable signs are an unusual request, pressure to act fast, a change of channel and a request to bypass a normal approval.
- The message asks for money, credentials, a code or a file, even if it reads perfectly.
- It creates urgency or secrecy (“before 3 pm”, “do not tell anyone yet”).
- It moves you to a new channel, such as email to WhatsApp or a call to a personal number.
- The sender is senior, new or external and the request skips the usual approval chain.
- A voice note or video call asks for a payment and the caller avoids a callback on a known number.
- A link leads to a login page, even one with a padlock (most Gulf phishing sites use HTTPS).
- A “bank” contacts you on WhatsApp, a channel SAMA has told Saudi banks not to use with customers.
- When in doubt, check the link with the NCA’s Tahqaq service or report it to your security team.
The single most effective rule is a callback on a known number before any payment, bank detail change or credential share. It defeats voice cloning, account takeover and lookalike domains equally.
What do NCA ECC controls require for phishing defence?
NCA ECC-2:2024 requires an awareness programme that covers phishing and email controls that filter it. Control 1-10-3 requires the awareness programme to cover secure handling of email, especially phishing emails, plus mobile devices and social media, and control 2-4-3 requires phishing and spam filtering, multi-factor authentication for webmail, and SPF, DKIM and DMARC on the entity’s domains.
The control text comes from the ECC-2:2024 document published on the NCA controls list:
- ECC 1-10-1
- Awareness programme delivered through multiple channels, periodically developed and approved
- ECC 1-10-3
- Programme covers secure handling of email (especially phishing), mobile devices, internet browsing and social media
- ECC 1-10-4
- Specialised training for cybersecurity staff, developers and IT staff, and executive and supervisory roles
- ECC 1-10-5
- Periodic review of how the awareness programme is implemented
- ECC 2-4-3
- Phishing and spam filtering, MFA for remote and webmail access, archiving, APT protection, SPF, DKIM and DMARC
ECC does not use the words “phishing simulation”. It does require you to show the awareness programme is implemented and periodically reviewed, and a simulation produces exactly that evidence. In September 2025 the NCA itself launched a Phishing Simulation Service on the Haseen portal so registered entities can run internal awareness campaigns and measure how well staff spot phishing.
The executive-training requirement in 1-10-4 matters here, because executives are the people attackers impersonate and the people most often targeted by AI voice and WhatsApp pretexts. For the full control set, see our NCA ECC compliance guide, and for Saudi financial institutions our SAMA Cyber Security Framework guide.
How do you run a phishing simulation in Saudi Arabia?
Run a phishing simulation in Saudi Arabia with written approval, a lawful basis for processing staff results, realistic multi-channel lures and a plan to act on what you find. The goal is to measure risk and improve reporting, not to catch people out.
- Get written approval and agree rules of engagement. Define who is in scope, which channels are allowed, which pretexts are off limits (for example, real government entities or salary cuts) and how to stop the campaign quickly.
- Handle staff data lawfully. Click and submission results are personal data under the Personal Data Protection Law (PDPL), overseen by the Saudi Data & AI Authority (SDAIA). Tell staff the programme exists, limit who sees individual results and never capture real passwords. Our Saudi PDPL compliance guide covers the obligations.
- Build lures from your real threat picture. Use bilingual Arabic and English pretexts that mirror the data above: bank and payment notices, delivery updates, fake meeting invites and executive requests.
- Go beyond email. Add SMS and voice pretexts, since IBM counts voice and SMS phishing within the costliest Saudi breach vector. For WhatsApp-style executive impersonation, test the payment approval process itself: does finance call back on a known number?
- Measure reporting, not just clicking. Track how fast the first person reports the message and how fast the security team responds.
- Check the technical controls in the same exercise. Record which lures the mail gateway stopped and confirm SPF, DKIM and DMARC enforcement for ECC 2-4-3.
- Train, fix and repeat. Give targeted training to the teams that struggled, tune filters, and rerun the campaign periodically to show the trend for ECC 1-10-5.
When credentials are captured in a simulation, the next question is what an attacker could do with them. That is where a red team operation helps: it follows the phish into the network and tests whether your SOC notices. Our red team vs penetration testing guide explains the difference.
What should a phishing simulation report measure?
A useful phishing simulation report measures click rate, credential submission rate, reporting rate and time to report, broken down by team and lure type. Those numbers show where training and controls need work, and give auditors dated evidence for ECC 1-10.
| Metric | What it tells you |
|---|---|
| Delivery rate | How many lures got past the mail gateway |
| Click rate | How many people opened the link or attachment |
| Credential submission rate | How many people would have handed over access |
| Reporting rate | How many people flagged the message to security |
| Time to first report | How quickly your organisation could react to a live campaign |
| Results by team and lure | Which departments and pretexts need targeted training |
Phishing is also only one way in. Many Saudi breaches start with an exposed application, so pair your simulation with penetration testing in Saudi Arabia of your internet-facing systems, and read how phishing feeds extortion in our post on ransomware in Saudi Arabia. For the money side, see the cost of a data breach in Saudi Arabia.
How Sumrite helps
Sumrite runs phishing simulations and red team operations for Saudi organisations end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Our campaigns cover email, SMS and voice, run under written approval and agreed rules of engagement, and report results by team, lure type and time to report, with training and mail-filter recommendations. Saudi teams can see how we work on our Saudi Arabia page.
Find out who would click before an attacker does
Tell us how many staff, which channels and which teams you want to test, and we will scope a phishing simulation built around the lures hitting Saudi organisations now. Book a scoping call.
Frequently asked questions
How common are phishing attacks in Saudi Arabia?
Social engineering, which includes phishing, was used in 30% of successful cyber attacks on Saudi organisations between Q2 2025 and Q1 2026, according to Positive Technologies. IBM's 2026 Cost of a Data Breach findings for Saudi Arabia put the average cost of a phishing-led breach, including voice and SMS phishing, at SAR 30.6 million.
How are attackers using AI in phishing against Saudi and Gulf organisations?
Attackers use generative AI to write fluent, personalised phishing emails and messages, and deepfake video and voice to build trust before a request. Positive Technologies documented AI-generated phishing delivered by email and WhatsApp in the Middle East in June 2025, and IBM found that 25% of malicious breaches in Saudi Arabia in its 2026 study were AI-enabled.
What is WhatsApp phishing and why does it matter in Saudi Arabia?
WhatsApp phishing is a social engineering attack sent through WhatsApp, often impersonating a senior executive, a bank or a government service to push an urgent payment or a malicious link. WhatsApp is widely used for business in the Gulf, and the Saudi Central Bank (SAMA) has barred banks from using instant messaging apps such as WhatsApp to communicate with customers, citing security concerns, as reported by Asharq Al-Awsat in March 2025.
Does NCA ECC require phishing awareness or phishing simulations?
The NCA Essential Cybersecurity Controls (ECC-2:2024) require a cybersecurity awareness programme that covers secure handling of email, especially phishing emails (control 1-10-3), and email filtering for phishing plus SPF, DKIM and DMARC (control 2-4-3). ECC does not name phishing simulations, but a simulation is the clearest evidence that the awareness programme works.
How should a Saudi organisation run a phishing simulation?
A Saudi organisation should run a phishing simulation with written approval, agreed rules of engagement and a lawful basis for processing staff results under the Personal Data Protection Law (PDPL). The campaign should mix email, SMS and voice lures in Arabic and English, measure reporting speed as well as click rates, and feed results back into training and mail-filter tuning.
