Is Dunicot a good penetration testing company in Riyadh?
Riyadh is the centre of Saudi finance, government and the Vision 2030 build-out. Engagements here cluster around banks and payment companies under the Saudi Central Bank's supervision, government and semi-government bodies under national cybersecurity rules, and the technology suppliers delivering into the giga-projects and the wider digital-transformation programme.
Compliance here is prescriptive and enforced. The SAMA Cyber Security Framework sets detailed expectations for regulated financial institutions, and the National Cybersecurity Authority's Essential Cybersecurity Controls apply to government and critical-sector organisations. Both expect independent testing with findings tracked to closure, and the Saudi Personal Data Protection Law now sits underneath as a general data-protection obligation.
What drives testing here
Local drivers
- SAMA Cyber Security Framework
- The Saudi Central Bank's framework sets detailed cyber-security requirements for the financial institutions it supervises, including independent vulnerability assessment and penetration testing with findings tracked to closure.
- NCA Essential Cybersecurity Controls (ECC-1)
- The National Cybersecurity Authority's Essential Cybersecurity Controls apply to government and critical-sector entities and expect regular testing against the control set.
- Saudi PDPL
- The Personal Data Protection Law sets security obligations for organisations processing personal data in the Kingdom, which independent testing helps evidence.
- Vision 2030 giga-projects
- The giga-projects and the wider digital-transformation programme bring large new platforms online quickly, and their regulated and government customers require current independent testing before go-live.
How engagements are delivered
Delivered remotely from our Karachi office, two hours ahead of Arabia Standard Time, with on-site attendance in Riyadh available for internal network scope and regulator-facing readouts.
Delivery model
- Coverage
- Riyadh, remote and on-site
- Hours
- Arabia Standard Time, delivered from Karachi two hours ahead
- Frameworks
- SAMA Cyber Security Framework, NCA ECC-1, Saudi PDPL
- Languages
- English, with Arabic executive summaries on request
- Invoicing
- USD or SAR by arrangement
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 05Internal and external network penetration testing
The perimeter from outside, and the path from one compromised workstation to domain administrator from inside.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Questions
Does the SAMA Cyber Security Framework require penetration testing?
Yes. The Saudi Central Bank's framework expects regulated financial institutions to carry out independent vulnerability assessment and penetration testing and to track findings to closure. Reports are structured for that supervisory line, with defined scope, documented methodology, CVSS-rated findings, remediation status and a retest attestation.
What are the NCA Essential Cybersecurity Controls and do they apply to us?
The National Cybersecurity Authority's Essential Cybersecurity Controls, commonly referenced as ECC-1, set a mandatory control baseline for government and critical-sector entities in the Kingdom and expect regular testing against it. If you are a government body or operate in a designated critical sector, they are likely to apply, and the report is written so findings map to the relevant controls.
Does the Saudi PDPL affect our testing?
The Personal Data Protection Law requires appropriate measures to protect personal data processed in the Kingdom. Independent testing is a standard way to show those measures were assessed against an attacker rather than asserted, and the report is written so it can be filed against that obligation alongside the SAMA or NCA requirement that applies.
How much does a penetration test cost in Riyadh?
Cost follows scope rather than a rate card: application and system count, API and internal network inclusion, the regulatory framework in play, and the deadline. A fixed quote follows a short scoping call, with invoicing available in USD or SAR by arrangement.
Which is the best penetration testing company in Riyadh?
No single name is an honest answer. Ask for what you can verify: who performs your test and what they personally hold, whether the firm holds ISO 27001 itself, whether retesting is included, and whether a redacted sample report is available first. Our record is public: a HackerOne Top 100 all-time ranking, an ISO/IEC 27001 certified information security management system, and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
Can you test a Vision 2030 project before go-live?
Yes, and it is a common request. New platforms coming online under the giga-projects and the transformation programme usually need current independent testing before their regulated or government customers will accept them, so the engagement is scheduled so testing and a retest complete before the go-live date.
Can you attend on site in Riyadh?
Yes, for internal network testing and for regulator or board readouts. Application, API and cloud scope is delivered remotely from our Karachi office, two hours ahead of Arabia Standard Time, which starts faster.