On this page
Delivered with a verified NCA-registered partner
Summit delivers VAPT with a verified NCA-registered partner firm and manages every engagement end to end. We have served 115+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Request a scoped quote.
Why NCA registration comes first
Since 1 August 2022, registration on NCA’s digital platform has been a regulatory requirement for any entity providing cybersecurity services, solutions or products in the Kingdom. Registration runs through Haseen, NCA’s National Cybersecurity Services Portal, and NCA publishes a list of registered service providers. Registration is separate from NCA’s licensing of specific services such as managed SOC (MSOC), which has its own Tier 1 and Tier 2 licences.
How to check: ask for the registered entity name, then look it up on NCA’s published list. If a subcontractor or partner performs the testing, confirm that entity is the registered one.
The 10-point checklist
- NCA registration of the firm performing the testing, verified on NCA’s list.
- Regulatory mapping. The proposal names the controls it supports, for example ECC 2-10 and 2-11, CSCC 2-9 and 2-10, SAMA CSF 3.2.4.
- Scope built from your asset inventory, not a generic “website + network” bundle. Under ECC 2-11-3-1, remote access, email and mobile apps are in scope.
- Manual testing depth. Ask what share of effort is manual and how business-logic and access-control flaws are tested.
- Qualified team. Named testers, relevant certifications, and CVs available for your file. CSCC explicitly requires a qualified team.
- Delivery location and access. For critical systems, CSCC 2-2-1-1 prohibits remote access from outside the Kingdom. Agree where testing originates.
- Data handling. How test data, screenshots and credentials are stored, encrypted and destroyed, in line with ECC 4-1 contract clauses and the PDPL.
- Reporting. An executive summary plus technical detail, severity ratings, reproduction steps and remediation guidance, in Arabic and English if your board needs it.
- Retest included, with a defined window, so you can show closure.
- Evidence support. Help assembling what an NCA, SAMA or SDAIA reviewer will ask for.
What drives VAPT cost in Saudi Arabia
| Driver | Why it moves the price |
|---|---|
| Number and type of assets | One web app vs. web + mobile + APIs + internal network |
| Application complexity | User roles, workflows, integrations, payment flows |
| Test depth | Black-box, grey-box or white-box; authenticated testing takes longer |
| Regulatory cadence | CSCC’s six-monthly tests and monthly assessments suit a programme price |
| Delivery constraints | On-site or in-Kingdom testing, out-of-hours windows for production banking systems |
| Reporting and evidence | Bilingual reports and control-mapped evidence packs add effort |
| Retesting | Included or charged separately |
Market reference: one published Saudi price guide puts a simple web application test at around SAR 12,000 and says enterprise-wide assessments can exceed SAR 300,000, with typical engagements between SAR 25,000 and SAR 100,000. Another KSA provider’s published range is SAR 20,000 to 40,000. Treat any figure as indicative. The only meaningful number is a quote against a defined scope.
A warning sign
A quote for “full VAPT” that arrives before anyone has asked about your assets. That is a scan, priced as a pentest.
Riyadh, Jeddah, Dammam: does location matter?
Less than you would think. Most external testing is location-independent. Location matters when:
- internal or critical systems need in-Kingdom or on-site access, common for government-linked entities in Riyadh;
- OT or industrial environments, such as those in the Eastern Province around Dammam and Jubail, need on-site work and safety coordination;
- retail and logistics groups in Jeddah need testing coordinated across branches and warehouses.
How Summit delivers VAPT
Summit delivers VAPT in partnership with a verified NCA-registered partner firm. You get a registered testing team, with Summit managing the engagement end to end: scoping from your asset inventory, testing, reporting mapped to your regulator’s controls, remediation workshops, retest and the evidence pack. We have served 115+ Saudi clients across Riyadh, Dammam, Jeddah and other cities. Many combine testing with a risk assessment from our services and Saudi PDPL support so one engagement feeds several obligations. For the frameworks themselves, start with our NCA ECC guide.
Get a scoped quote
Send us your asset list and we will return a scope and quote mapped to your regulatory obligations. Request VAPT scoping.
Related reading: ECC-2:2024 penetration testing · SAMA CSF penetration testing · PDPL enforcement 2026
Frequently asked questions
How much does penetration testing cost in Saudi Arabia?
It depends on scope. Published Saudi price guides put a simple web application test from around SAR 12,000, typical engagements between SAR 25,000 and SAR 100,000, and enterprise-wide assessments above SAR 300,000. Get a quote against your asset list.
Does a VAPT provider in Saudi Arabia need NCA registration?
NCA requires any entity providing cybersecurity services, solutions or products in the Kingdom to register on its platform, a requirement in force since 1 August 2022.
How do I verify a provider's NCA registration?
Ask for the registered entity name and check it against NCA's published list of registered service providers.
How long does a VAPT engagement take?
A single web application typically takes one to two weeks of testing plus reporting. Larger multi-asset scopes take longer. Allow time for a retest.
Can VAPT be done remotely?
External testing usually can. For critical systems under CSCC, remote access from outside the Kingdom is prohibited, so testing access must come from inside Saudi Arabia.
