Web Application Penetration Testing in Saudi Arabia: Scope, Method and Compliance A practical guide from Sumrite.

Most Saudi entities already know they need “a pentest”. Where they struggle is scope, method and evidence: which applications, tested how, and documented in a way an NCA or SAMA reviewer accepts on first read. This guide answers those three questions.

Why does web application penetration testing matter in Saudi Arabia?

Web application penetration testing matters in Saudi Arabia because web resources are among the most frequently hit assets in the region, and because NCA and SAMA rules name web applications explicitly. A Saudi organisation that cannot show a recent, manual web application test has both a security gap and a compliance gap.

On the threat side, Positive Technologies’ Middle East cyberthreat report, covering Q2 2025 to Q1 2026, found that web resources were the second most commonly affected asset type in successful attacks (49%), behind computers, servers and network equipment (63%). The same report places Saudi Arabia as the second most targeted country in the region, at 12% of attacks. For the wider picture, see our analysis of cyber threats facing Saudi businesses in 2026.

On the regulatory side, web applications are where customer data, payments and government services meet the internet. A single broken access control flaw in a customer portal can expose personal data that the Personal Data Protection Law (PDPL) requires you to protect, which is why web testing sits at the centre of our penetration testing guide for Saudi Arabia.

Which NCA ECC controls cover web application security and testing?

Four ECC-2:2024 subdomains touch web applications: ECC 2-15 (web application security), ECC 2-11 (penetration testing), ECC 2-10 (vulnerabilities management) and ECC 1-6 (cybersecurity in project management and software development). A good web application penetration test produces evidence for all four, not only 2-11.

The table below is paraphrased from the official ECC-2:2024 text published by NCA.

ECC-2:2024 control	What it requires	What the web app pentest proves
ECC 2-15 Web Application Security	Defined, implemented and periodically reviewed protection requirements for external web applications	Whether the WAF, architecture, TLS and authentication actually hold up
ECC 2-11 Penetration Testing	Periodic tests of all internet-facing services, explicitly including websites and web applications	The test itself, its scope and its retest
ECC 2-10 Vulnerabilities Management	Periodic vulnerability assessment, severity classification and risk-based remediation	Severity-rated findings that feed your remediation tracker
ECC 1-6 Project and software development	Secure coding standards and security review before applications go live	Pre-launch testing of new releases and major changes

Applicability matters too. ECC-2:2024 is mandatory for government agencies, their affiliated companies inside and outside the Kingdom, and private entities that own, operate or host Critical National Infrastructure. Our NCA ECC compliance guide explains who is in scope and how the four domains fit together.

What does ECC 2-15 require for external web applications?

ECC 2-15 requires entities to identify, document, approve, implement and periodically review cybersecurity requirements for their external web applications, with five minimum requirements set out in ECC 2-15-3. The objective, in NCA’s words, is “to ensure the protection of external web applications of the entity against cyber risks.”

Here is how each ECC 2-15-3 minimum translates into test cases:

2-15-3-1 Web application firewall

Confirm the WAF is in front of every external app and hostname, and test whether common payloads and encoding tricks bypass it. A WAF that only covers www is a finding.

2-15-3-2 Multi-tier architecture

Check that the web tier cannot reach the database directly, that admin interfaces are not exposed, and that a compromise of one tier does not hand over the next.

2-15-3-3 Secure protocols (e.g. HTTPS)

Test TLS versions and ciphers, HSTS, mixed content, and any plain-HTTP API or callback endpoints.

2-15-3-4 Secure usage policy

Verify that the policy shown to users matches how the app behaves: password rules, session expiry and account recovery.

2-15-3-5 User authentication

NCA asks for authentication based on impact assessment, including suitable authentication factors and their number. Test MFA enrolment, bypass, reset flows and session handling.

ECC 2-15-4 then requires the protection requirements themselves to be periodically reviewed. Attaching the pentest report and retest results to that review gives the assessor a dated, independent record that the controls worked in practice.

One caution: a WAF does not satisfy ECC 2-11. Broken access control, insecure direct object references and business-logic abuse pass straight through most WAF rule sets because the requests look legitimate.

What should a web application penetration test in Saudi Arabia cover?

A web application penetration test in Saudi Arabia should cover every internet-facing web application and its supporting components, tested authenticated across every user role, with the APIs behind the front end in scope. ECC 2-11-3-1 says scope is “all internet-facing services and their technical components”, so testing the main website alone rarely survives an assessment.

Use this scoping checklist before you ask for a quote:

For SaaS platforms, the deeper checklist in our web application VAPT guide covers tenant isolation and integrations in detail. If the application’s APIs serve mobile apps or partners, scope them as a separate API security test.

Which method should a web application penetration test follow?

A web application penetration test should follow the OWASP Web Security Testing Guide (WSTG) for its test cases and report findings against the OWASP Top 10:2025 categories. NCA does not mandate a named methodology, but its Penetration Testing Standard template asks for a defined and approved methodology and for the approach (black, grey or white box) to be declared, and OWASP is the reference assessors recognise.

The OWASP resources that matter most:

• OWASP Web Security Testing Guide: the test case catalogue a tester works through.
• OWASP Top 10:2025: the risk categories most reports map to, with Broken Access Control at A01.
• OWASP API Security Top 10 (2023): for the APIs behind the application, where broken object level authorisation dominates.

A typical engagement runs in five stages:

Grey-box testing, with credentials and API documentation, gives the best coverage per testing day. Black-box tests look realistic but spend budget on discovery rather than on the flaws that matter. Our explainer on black, grey and white box testing covers the trade-offs.

How often should Saudi organisations test their web applications?

ECC-2:2024 requires penetration tests to be conducted periodically without setting an interval, so Saudi entities should test every internet-facing web application at least annually and before major releases, and SAMA-regulated firms must test customer and internet facing services annually. The interval you choose must be written into your approved penetration testing policy under ECC 2-11-1.

Source	What it says about frequency
NCA ECC-2:2024, ECC 2-11-3-2	Penetration tests are conducted periodically (no fixed interval)
NCA Penetration Testing Standard template	Internet-facing systems on a scheduled and regular basis; critical systems every 6 months
SAMA Cyber Security Framework, section 3.2.4	Customer and internet facing services subject to annual review and penetration tests
SAMA Cyber Resilience Fundamental Requirements, 3.2.6	Penetration testing twice a year as a minimum, or after a major or critical change (entities entering SAMA’s sandbox or seeking a licence)

Note that the NCA templates are guidance documents aligned with the earlier ECC-1:2018, not part of the ECC-2:2024 text. They are still the best indication of what NCA considers reasonable. Teams that ship weekly often find an annual test too coarse; our post on PTaaS and continuous pentesting in Saudi Arabia explains how to keep testing in step with releases. For the full SAMA position, read SAMA penetration testing requirements for banks.

What evidence should a web application pentest report give an NCA or SAMA reviewer?

A web application pentest report for a Saudi reviewer should show scope reconciled to the asset inventory, the methodology used, severity-rated findings with evidence, a mapping to ECC 2-11 and ECC 2-15 (or SAMA CSF 3.2.4), and retest results. A report that lists findings without scope or retest leaves the reviewer with open questions.

Assemble the evidence pack in this order:

1. Approved penetration testing policy that states the interval (ECC 2-11-1).
2. Scope list compared with the asset inventory, with any exclusions justified.
3. The report itself: methodology, approach, dates, testers, findings and fix guidance.
4. Remediation tracker with owners and due dates.
5. Retest report proving critical and high findings are closed.
6. The ECC 2-15-4 review record of web application protection requirements, referencing the test.

Our sample VAPT report shows the format, and what makes a VAPT report worth paying for explains what separates an audit-ready report from a scanner export. If you are still comparing vendors, use our buyer’s checklist for Saudi penetration testing companies, and for budget planning see what drives penetration testing cost in Saudi Arabia.

How Sumrite helps

Sumrite runs manual, expert-led web application VAPT for Saudi organisations end to end with our verified NCA-registered partner firm. Every engagement is authenticated across your roles, follows OWASP WSTG, maps findings to ECC 2-11, ECC 2-15 and SAMA CSF 3.2.4 where relevant, and includes a retest. Through our Saudi Arabia service, the Sumrite VAPT report for Saudi reviews is delivered in 48 hours.