SAMA Ethical Red Teaming vs Penetration Testing: What Saudi Financial Entities Need Explained by Sumrite.

Saudi banks and insurers often ask whether a red team exercise can replace their annual penetration test, or whether a “red team” from a vendor satisfies FEER. SAMA’s own text answers both questions. This guide compares the two activities using the FEER and SAMA CSF wording, and sits within our SAMA Cyber Security Framework guide series. For the general, non-SAMA comparison, see red team vs penetration testing.

What is the SAMA FEER red teaming framework?

The SAMA FEER framework is the Saudi Central Bank’s guide for Member Organizations on preparing and executing controlled, threat-intelligence-based red teaming tests against their live production environment. SAMA issued it under Circular 562240000067 dated 13 May 2019 (9/9/1440H), and the SAMA Rulebook lists it as in force as of November 2026.

According to the FEER introduction on the SAMA Rulebook, the Red Teaming Provider uses the latest attack tactics, techniques and procedures (TTPs) to try to reach the Member Organization’s most important and valuable information assets, while testing its detection and response capabilities. The framework makes two framing points:

• Red teaming is not an audit. It is a simulation test that gives insight into the resilience and effectiveness of implemented controls and processes.
• Red teaming is not a penetration test. A penetration test assesses one or more specific information assets; red teaming replicates a targeted and realistic attack against the entire Member Organization, performed in a controlled manner.

FEER also aims to share the intelligence and lessons learned from each test to improve the cyber resilience of the Saudi financial sector as a whole.

What is the difference between SAMA red teaming and penetration testing?

The difference is that SAMA penetration testing finds vulnerabilities in a predefined set of systems, while SAMA red teaming tests whether the organisation detects and responds to a realistic, goal-driven attack. FEER section 2.3 sets out the contrast directly.

The table below follows the comparison in FEER section 2.3, Penetration Testing Versus Red Teaming:

Dimension	Penetration testing	SAMA FEER red teaming
Goal	Find vulnerabilities	Test resilience against realistic attacks
Scope	Predefined subset of systems	Realistic access paths across the whole organisation
Controls tested	Mainly preventive	Mainly detection and response
Method	Efficiency: cover the scope	Realistic simulation of a threat actor
Techniques	Mapping, scanning, exploitation	Tactics, techniques and procedures (TTPs)
Post-exploitation	Very limited	Extensive, focused on critical assets or functions
Recurrence	Part of the development lifecycle	Periodic exercise
SAMA source	SAMA CSF 3.2.4 (annual for customer and internet-facing services)	FEER (at least once every three years)

FEER also describes the attack model it uses, the Cyber Kill Chain (reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives), which is why red team scenarios often include phishing simulations and physical or social engineering paths that a scoped pentest excludes.

Who must run a SAMA red teaming test, and how often?

FEER applies to all Member Organizations in the financial sector regulated by SAMA, and each should be tested at least once every three years. SAMA can also select any Member Organization and request a red teaming test, and Member Organizations may run tests on their own initiative.

These points come from FEER section 1 on the SAMA Rulebook, which also requires that tests target business-critical, live production systems and be run with certified and experienced Red Teaming Providers. Appendix A of FEER sets the requirements for Red Teaming Providers, and the provider must be approved through SAMA’s Green Team before the engagement.

Compare that with penetration testing, which SAMA CSF requires every year for customer and internet-facing services under subdomain 3.2.4. A three-year red teaming cycle sits on top of an annual testing cycle; it does not stretch it.

What are the four phases of a SAMA FEER red teaming exercise?

A SAMA FEER red teaming exercise runs through four phases: Preparation, Scenario, Execution and Lessons Learned. Each phase has defined outputs and approvals involving the Member Organization, the Red Teaming Provider and SAMA.

The phase structure below follows the FEER table of contents on the SAMA Rulebook:

FEER Execution Phase rules also require the provider to tell the White Team Leader immediately about any scripts, code or malware installed and any user IDs created, compromised or reused, and require a final report agreed by all teams with a copy submitted to SAMA. Appendix B lists the reports: the Red Team Evaluation Report, the Blue Team Report, the Remediation Plan and the Red Teaming Test Summary Report.

Which teams take part in a SAMA FEER exercise?

A SAMA FEER exercise involves four teams: the Green Team from SAMA, the White Team inside the Member Organization, the Blue Team that defends, and the Red Team from the Red Teaming Provider. Only the White Team knows the test is happening.

Green Team

Provided by SAMA. Appoints the Test Manager, approves the selection of the Red Teaming Provider and can add sector-specific threat intelligence.

White Team

A limited number of security and business experts (for example the CISO) who are the only staff aware of the test and act as single points of contact.

Blue Team

The Member Organization's cyber security monitoring team, such as the SOC. FEER says the Blue Team should never be informed about the test.

Red Team

The selected third-party Red Teaming Provider that executes the attack scenarios and delivers the threat intelligence landscape.

FEER section 2.2 limits the overall number of staff involved in the engagement to a maximum of five people, to avoid wide disclosure of the planned attack simulation. That secrecy is the main operational difference from a penetration test, where the IT team usually knows the window and whitelists the testers.

Does SAMA red teaming replace penetration testing?

SAMA red teaming does not replace penetration testing: FEER states that red teaming is not a penetration test, and SAMA CSF 3.2.4 still requires annual review and penetration tests of customer and internet-facing services. A Saudi financial entity needs both, on different cycles, for different purposes.

In practice the two reinforce each other. Penetration tests remove the known, scoped weaknesses each year, so the red team spends its time on detection and response rather than on easy findings. The red team then exposes gaps that no scoped pentest would reach, such as missing alerts on lateral movement or slow escalation from the SOC. Institutions also in scope of the National Cybersecurity Authority’s Essential Cybersecurity Controls (ECC-2:2024) still need periodic penetration tests under ECC 2-11 as well; see NCA ECC vs SAMA CSF.

Need	Right activity
Annual evidence for SAMA CSF 3.2.4	SAMA penetration testing
Test before a new app or API goes live	Penetration test
SAMA has selected you for FEER, or your three-year cycle is due	FEER red teaming exercise
Board asks whether the SOC would catch a real attack	Red teaming
Measure staff susceptibility to phishing	Phishing simulation, often a red team scenario

How should a Saudi financial entity prepare for its first FEER test?

A Saudi financial entity should prepare for its first FEER test by closing known penetration test findings, confirming the SOC’s monitoring coverage, and forming a White Team with clear stop conditions before procuring a Red Teaming Provider. Preparation shortens the Preparation and Scenario phases and makes the Lessons Learned phase more useful.

How Sumrite helps

Sumrite delivers red team operations and penetration testing for Saudi financial entities end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. We help Member Organizations get FEER-ready: closing SAMA CSF 3.2.4 findings first, running readiness red team exercises and phishing scenarios, and producing reports that separate red team, blue team and remediation outputs. Saudi teams can start on our Saudi Arabia page, and the Saudi penetration testing guide maps every test type to SAMA and NCA controls.