Riyadh · NCA · SAMA · CST · PDPL
VAPT services in Riyadh, mapped to NCA and SAMA.
Sumrite tests web applications, APIs, mobile apps, networks and cloud for organisations in Riyadh, with reports written for the NCA, SAMA and SDAIA reviews your buyers and regulators run. 100+ clients in the Kingdom.
Sumrite provides VAPT services in Riyadh for banks, fintechs, government suppliers, healthcare providers and SaaS companies. It runs expert-led penetration tests, maps the report to NCA Essential Cybersecurity Controls, the SAMA Cyber Security Framework, CST requirements and the Saudi PDPL, and routes formal NCA assessments through its local partner firm, so Riyadh clients deal with one team.
Riyadh sectors and the rules they test against
| Sector | Regulator or framework | What the test supports |
|---|---|---|
| Banks, fintechs and payment companies | SAMA Cyber Security Framework | Vulnerability management and penetration testing evidence for SAMA reviews |
| Government entities and suppliers | NCA ECC | Penetration testing under ECC 2-11 and supplier security reviews |
| Cloud and SaaS providers | NCA CCC | Cloud control evidence for providers and tenants |
| Telecom and digital platforms | CST cybersecurity regulatory framework | Penetration testing of internet-facing services |
| Any organisation handling personal data | Saudi PDPL | Tested security measures for personal data under SDAIA oversight |
How Riyadh engagements are delivered
- Scope and NDA. Assets, environments and the frameworks your reviewer uses are agreed before any credentials are shared.
- Expert-led testing. Sumrite testers work against the hosts you authorise; data that must stay in the Kingdom stays there.
- Report with an Arabic summary. Technical findings in English with an Arabic executive summary, mapped to NCA, SAMA or PDPL references.
- Formal assessments through our local partner. Where an NCA-registered firm must sign off, Sumrite routes that step through its local partner and keeps managing the engagement.
- Retest. Fixed findings are retested and the report updated.
خدمات اختبار الاختراق في الرياض
تقدّم Sumrite خدمات تقييم الثغرات واختبار الاختراق (VAPT) للبنوك وشركات التقنية المالية والجهات الحكومية وموردي الحلول السحابية في الرياض، مع تقارير مرتبطة بالضوابط الأساسية للأمن السيبراني (ECC) الصادرة عن الهيئة الوطنية للأمن السيبراني، وإطار الأمن السيبراني للبنك المركزي السعودي (ساما)، ونظام حماية البيانات الشخصية.
لدينا أكثر من 100 عميل في المملكة في الرياض وجدة والدمام، ونتولى المشروع كاملًا من تحديد النطاق حتى إعادة الاختبار، مع شريك محلي للتقييمات الرسمية.
Frequently asked questions
Do you provide VAPT services in Riyadh?
Yes. Sumrite has more than 100 clients in Saudi Arabia, including in Riyadh, and delivers VAPT end to end, with formal NCA assessments routed through its local partner firm.
Can the report be used for NCA ECC and SAMA reviews?
Yes. Findings are mapped to NCA Essential Cybersecurity Controls and, for financial institutions, the SAMA Cyber Security Framework, so control owners can attach the report to their review.
Is the report available in Arabic?
The technical report is in English so developers can follow it exactly, with an Arabic executive summary for leadership and reviewers.
Do you also cover Jeddah and Dammam?
Yes. Sumrite works with clients across the Kingdom, including Jeddah and Dammam.
Saudi Arabia
Testing for a Riyadh buyer or regulator?
Send the questionnaire or the control list. NDA first, fixed-scope quote.