On this page
- How big is the Saudi Arabia cybersecurity market in 2026?
- How fast is the Saudi cybersecurity market growing?
- Who spends more on cybersecurity in Saudi Arabia: government or the private sector?
- Is Saudi cybersecurity spending going to products or services?
- How large is the Saudi cybersecurity workforce?
- Where is Saudi cybersecurity demand heading?
- What does Saudi market growth mean for testing your own defences?
- How Sumrite helps
- Frequently asked questions
Market-size figures for Saudi cybersecurity are everywhere, and they rarely agree. Commercial research firms define the market in different ways and publish forecasts behind paywalls. This post uses one source as its backbone: the National Cybersecurity Authority’s own annual report on Key Economic Indicators in the Cybersecurity Sector, which is the official measure of the Kingdom’s market. Every number below links to the NCA’s page and is current as of November 2026.
- Market size (2025)
- SAR 16.3 billion
- Growth (CAGR 2023 to 2025)
- 10.7%
- Private sector share
- 69% (SAR 11.2 billion)
- Government share
- 31% (approx. SAR 5.1 billion)
- Products vs services
- SAR 8.3 billion (51%) vs SAR 7.9 billion (49%)
- Workforce
- More than 22,000 professionals
- GDP contribution
- Approx. SAR 20 billion (0.42% of GDP)
- Source
- [NCA, 14 October 2026](https://nca.gov.sa/en/news/2689/)
How big is the Saudi Arabia cybersecurity market in 2026?
The latest official figure puts the Saudi Arabia cybersecurity market at SAR 16.3 billion, measured for calendar year 2025 and published by the National Cybersecurity Authority (NCA) on 14 October 2026. The NCA defines the market as total spending on cybersecurity products and services by public and private entities in the Kingdom.
The number comes from the NCA’s Report on Key Economic Indicators in the Cybersecurity Sector in the Kingdom 2026. Note the timing: the 2026 edition reports 2025 data, so “the 2026 market size” in news coverage usually means this SAR 16.3 billion figure for 2025 spending.
The NCA classifies the sector into 5 main categories and 25 activities, covering more than 100 cybersecurity products and services. That classification matters when you compare the NCA’s number with commercial estimates, which often use narrower or broader definitions and frequently report in US dollars.
How fast is the Saudi cybersecurity market growing?
The Saudi cybersecurity market grew at a compound annual growth rate (CAGR) of 10.7% between 2023 and 2025, according to the NCA. Year on year, the NCA’s two most recent reports show the market moving from SAR 15.2 billion in 2024 to SAR 16.3 billion in 2025.
The NCA’s previous edition, the Key Economic Indicators in the Cybersecurity Sector 2025 report published on 17 September 2025, gives the 2024 baseline. Setting the two reports side by side:
| Indicator (NCA) | 2024 | 2025 |
|---|---|---|
| Market size | SAR 15.2 billion | SAR 16.3 billion |
| Government spending | SAR 4.8 billion (32%) | approx. SAR 5.1 billion (31%) |
| Private sector spending | SAR 10.3 billion (68%) | SAR 11.2 billion (69%) |
| Products | SAR 7.7 billion (51%) | SAR 8.3 billion (51%) |
| Services | SAR 7.5 billion (49%) | SAR 7.9 billion (49%) |
| GDP contribution | approx. SAR 18.5 billion | approx. SAR 20 billion |
| Workforce | over 21,000 | over 22,000 |
| Women in the workforce | 32% | 33% |
Sources: NCA, September 2025 and NCA, October 2026.
By our arithmetic from those two figures, the market grew by about 7% from 2024 to 2025. The NCA reported 14% growth from 2023 to 2024 in its earlier edition. Growth is still firmly positive, but the second year was slower than the first.
Who spends more on cybersecurity in Saudi Arabia: government or the private sector?
The private sector spends more than twice as much as government on cybersecurity in Saudi Arabia: SAR 11.2 billion (69%) against approximately SAR 5.1 billion (31%) in 2025, according to the NCA. The private share edged up from 68% in 2024.
That split surprises people who assume Saudi cybersecurity is driven mainly by government programmes. Government still sets the rules through the NCA, the Saudi Central Bank (SAMA), the Saudi Data & AI Authority (SDAIA) and the Communications, Space and Technology Commission (CST), but most of the spending happens in banks, telecoms, energy, retail, healthcare and technology companies.
In our view, three things push private-sector spending:
- Regulation reaching further into the private sector. The NCA’s Essential Cybersecurity Controls (ECC-2:2024) apply to government agencies, their affiliated companies, and private-sector entities that own, operate or host Critical National Infrastructures (CNIs), and the NCA strongly encourages all other entities in the Kingdom to use them. See our NCA ECC compliance guide.
- Personal data protection. The Personal Data Protection Law (PDPL), overseen by SDAIA, requires appropriate safeguards for personal data. Our Saudi PDPL compliance guide explains what that means in practice.
- Rising attack pressure. Positive Technologies ranked Saudi Arabia the second most targeted country in the Middle East between Q2 2025 and Q1 2026. See cyber threats facing Saudi businesses in 2026.
Is Saudi cybersecurity spending going to products or services?
Saudi cybersecurity spending is split almost evenly: SAR 8.3 billion (51%) on products and SAR 7.9 billion (49%) on services in 2025, according to the NCA. The split was the same 51/49 in 2024.
Products cover software and hardware such as firewalls, endpoint protection, identity tools and monitoring platforms. Services cover consulting, managed security, compliance work and testing. Services matter because tools only help if they are configured, monitored and tested. A firewall bought in 2025 does not prove that the web application behind it resists attack in 2026.
For buyers, that even split is a useful check. If your budget is mostly licences, ask who is testing whether those tools actually stop an attacker.
How large is the Saudi cybersecurity workforce?
More than 22,000 cybersecurity professionals worked in Saudi Arabia in 2025, according to the NCA, with the workforce growing at about 5.9% a year between 2023 and 2025. Women made up 33% of that workforce, against a global average of approximately 22% cited by the NCA.
The workforce grew more slowly than spending (5.9% a year against 10.7%). In practice, this means more of the work is delivered through products, managed services and external specialists, rather than only by in-house teams.
ECC-2:2024 also shapes who fills these roles. Our post on ECC-2 control 1-2-2 and staffing cybersecurity roles with Saudi professionals explains the requirement.
Where is Saudi cybersecurity demand heading?
Demand is moving towards the requirements Saudi regulators have already written into force: evidence of periodic testing, cloud security, personal data protection and third-party assurance. The NCA does not publish a market forecast in its report, so the direction below is our reading of the regulatory signals, not an official projection.
Testing evidence
ECC-2:2024 requires penetration tests to be conducted periodically (ECC 2-11) alongside periodic vulnerability assessment (ECC 2-10). See [NCA penetration testing requirements](/blog/nca-ecc-penetration-testing-requirements).
Cloud security
The NCA's Cloud Cybersecurity Controls apply to cloud providers and tenants. See [NCA CCC-2:2024 explained](/blog/nca-ccc-cloud-cybersecurity-controls-testing).
Personal data
PDPL enforcement by SDAIA makes data-protection safeguards an audit topic. See our [PDPL compliance checklist](/blog/pdpl-compliance-checklist).
Vendor assurance
Saudi buyers in scope of NCA controls ask foreign SaaS suppliers for security evidence. See [selling SaaS into Saudi Arabia](/blog/selling-saas-saudi-arabia-security-requirements).
What to watch for in the next NCA edition:
- Whether the services share rises above 49% as compliance-driven work grows
- Whether private-sector spending keeps increasing its share beyond 69%
- Whether workforce growth (5.9% a year) catches up with spending growth (10.7%)
- Whether growth returns to double digits after the slower 2024 to 2025 year
What does Saudi market growth mean for testing your own defences?
A growing security budget does not prove that your defences work; only testing does. For most Saudi organisations, the most useful part of that spending is a manual penetration test of internet-facing systems, repeated on a schedule that satisfies NCA ECC-2:2024 control 2-11.
The threat data supports that priority. IBM’s 2026 findings for Saudi Arabia put the average data breach cost at SAR 27 million, with breaches through exploited public-facing applications costing SAR 34.7 million on average, according to IBM.
- Start with a free outside-in view. Run a one-minute external scan at scan.sumrite.com.
- Pentest public-facing applications and APIs. Commission web application VAPT and API security testing.
- Cover cloud and network. Add a cloud security assessment and network VAPT where your workloads live.
- Test detection. Use red team operations to check whether your monitoring catches a real intrusion.
- Keep pace with releases. Move to continuous penetration testing (PTaaS) if you ship often.
Our pillar guide to penetration testing in Saudi Arabia maps each test type to NCA ECC and the SAMA Cyber Security Framework. If you are comparing vendors, use our checklist for choosing a penetration testing company in Saudi Arabia.
How Sumrite helps
Sumrite runs penetration testing, cloud security assessments and red team operations for Saudi organisations end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Our reports map findings to NCA ECC-2:2024 and include retest evidence for auditors. Visit our Saudi Arabia page to see how to get a Sumrite VAPT report for Saudi reviews in 48 hours, or review a sample VAPT report.
Make sure your security spend is working
Find out whether the defences you have paid for would stop a real attacker. Book a scoping call.
Frequently asked questions
How big is the Saudi Arabia cybersecurity market?
The Saudi Arabia cybersecurity market was worth SAR 16.3 billion in 2025, according to the National Cybersecurity Authority (NCA) report on Key Economic Indicators in the Cybersecurity Sector, published on 14 October 2026. The NCA defines the market as total spending on cybersecurity products and services by public and private entities.
How fast is the Saudi cybersecurity market growing?
The Saudi cybersecurity market grew at a compound annual growth rate of 10.7% between 2023 and 2025, according to the National Cybersecurity Authority (NCA). The NCA's previous report put the 2024 market at SAR 15.2 billion, against SAR 16.3 billion for 2025.
Who spends the most on cybersecurity in Saudi Arabia?
The private sector spends the most on cybersecurity in Saudi Arabia, at SAR 11.2 billion or 69% of the market in 2025, according to the National Cybersecurity Authority (NCA). Government spending was approximately SAR 5.1 billion, or 31%.
How many cybersecurity professionals work in Saudi Arabia?
More than 22,000 cybersecurity professionals worked in Saudi Arabia in 2025, according to the National Cybersecurity Authority (NCA), with the workforce growing at about 5.9% a year between 2023 and 2025. Women made up 33% of the Saudi cybersecurity workforce, against a global average of about 22% cited by the NCA.
How much does cybersecurity contribute to Saudi GDP?
The Saudi cybersecurity sector contributed approximately SAR 20 billion to GDP in 2025 at current prices, according to the National Cybersecurity Authority (NCA). That equals 0.42% of total GDP and 0.71% of non-oil activity, split between SAR 9.7 billion direct and SAR 10.3 billion indirect contribution.
