Many KSA enterprises have done a penetration test — once, three years ago, by an offshore vendor whose 200-page report was largely templated findings with screenshots from someone else’s environment. That’s not a penetration test. It’s a vulnerability scan with a fancy cover page and an inflated invoice.

Real adversary emulation requires certified testers with proven methodology, KSA-licensed individuals where the engagement requires it, and reporting that actually maps to your threat model and regulatory exposure. EIE’s penetration testing practice is built on that foundation.

Penetration test types

External network — your internet-exposed assets. Web servers, VPN concentrators, mail gateways, anything reachable from the public internet. Identifies exploitable weaknesses an external attacker could leverage.

Internal network — assumed compromise. Either a malicious insider or an attacker who has bypassed perimeter defences. Tests how far they can move laterally, what they can access, what they can exfiltrate.

Web application — OWASP Top 10 plus business logic flaws. Authentication bypass, authorization escalation, injection vulnerabilities, but also business-rule violations that scanners miss (e.g., manipulating order pricing, bypassing approval workflows).

Mobile application — iOS and Android. Reverse engineering, runtime analysis, transport security, authentication implementation, certificate pinning effectiveness.

Cloud configuration — Azure, AWS, GCP, M365. IAM policies, storage exposure, network controls, compute hardening, container and Kubernetes configuration.

IAM and identity — Azure AD/Entra, Okta, federation. Conditional Access bypass attempts, OAuth grant abuse, service principal escalation, MFA fatigue attacks, password spraying.

Wireless and RF — Wi-Fi enterprise authentication, evil-twin attacks, rogue access points, Bluetooth, 802.15.4 in IoT contexts.

Physical and social engineering — site reconnaissance, tailgating tests, badge cloning, phishing campaigns, vishing (phone-based social engineering). Done with explicit scope and authorization, with safe rules of engagement.

Red team — multi-vector, time-boxed adversary emulation. Combines network, identity, social engineering to simulate a realistic threat actor with specific objectives. Tests not just controls but the SOC’s detection and response capability.

Certified testers

Certifications matter not for the badge but because they demonstrate verified capability. Our testers hold:

CREST CRT, CCT — Council of Registered Ethical Security Testers. Industry-standard for technical testing competence.
GIAC GPEN, GWAPT, GMOB, GXPN — SANS-affiliated certifications across penetration testing specialisations.
OSCP, OSCE, OSWE — Offensive Security’s hands-on practical certifications.
CISSP, CISM — for engagement leads requiring broader security architecture context.

For engagements involving sensitive sectors or government data, KSA national testers are available on request. Our testing for SAMA-regulated banks and NCA-classified entities is performed by individuals appropriately cleared and licensed.

Methodology

We don’t make up methodology. We follow established standards.

OWASP Testing Guide — for web and mobile application testing. Comprehensive, regularly updated, broadly accepted.

Penetration Testing Execution Standard (PTES) — for network and infrastructure testing. Covers pre-engagement, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation, reporting.

MITRE ATT&CK framework — for red team scenario design. Maps adversary tactics, techniques, and procedures (TTPs) so we can emulate specific threat actors relevant to your industry and threat landscape.

TIBER-EU — for financial services where SAMA-aligned, intelligence-led testing is appropriate. Threat-intelligence-based ethical red teaming with specific governance.

Engagement types

Annual compliance pen test — most KSA banks under SAMA mandate require annual external pen testing. We deliver in SAMA-aligned format with executive summary suitable for regulatory submission.

Pre-launch testing — before a new application, platform, or service goes live. Catches issues while remediation is cheap.

M&A due diligence — assessing the target organization’s security posture before acquisition. Identifies inherited risks.

Red team continuous (subscription) — ongoing monthly red team activity testing detection capability. Suitable for mature security programs.

Purple team — collaborative testing where red team and blue team work together to improve detection. Less about findings, more about capability building.

Deliverables

Reporting is where most penetration testing engagements fail. A 200-page templated report that nobody reads is not a deliverable; it’s a dressed-up invoice.

Our deliverables:

Executive summary — board-grade, 2-4 pages. Risk-rated findings, business impact, recommended actions, comparison to industry baseline.

Technical findings report — full details with proof-of-concept evidence (screenshots, command output, exploit chains). Not templated; written specifically for your environment.

Remediation guidance — prioritized by EPSS where applicable, asset value, and exploitability. Specific guidance: not “patch the system” but “apply patch X, configure setting Y, validate via Z”.

Re-test included — after your remediation, we re-test affected findings to verify closure. Documentation of cleared findings becomes part of your audit evidence.

Compliance-aligned report formats — NCA ECC mapping, SAMA Cybersecurity Framework mapping, ISO 27001 Annex A mapping where relevant. Auditors get what they expect.

KSA-specific considerations

NCA Cybersecurity Service Provider classification — engagements for certain government and critical-infrastructure clients require providers licensed by the NCA. EIE holds the relevant classifications.

SAMA reporting alignment — banking-specific reporting format. Pre-formatted for SAMA examiner review.

Coordination with internal SOC and IT teams — pen tests can trigger SOC alerts. We coordinate to ensure your team is aware (without telegraphing exact actions) so they can monitor without panic.

Authorized testing windows — KSA operational realities. Hajj season for hospitality, Ramadan for financial services, prayer times daily. Testing windows are scoped to avoid disruption.

Red team vs purple team

Red team is unilateral. The blue team (your defenders) doesn’t know it’s happening (or knows only at the highest level). Tests detection capability honestly.

Purple team is collaborative. Red team executes a TTP; blue team observes whether they detect; if not, they tune detection together; repeat. Tests and improves detection capability simultaneously.

Most mature programs use both. Red team annually for honest assessment. Purple team continuously for capability building.

Frequently asked questions

Is the test actually performed in KSA or offshored? Performed by EIE testers, who are based in KSA for in-Kingdom requirements. For some engagements, regional team members may participate under defined authorization.

What’s the SAMA / NCA reporting alignment? Reports are produced in SAMA Cybersecurity Framework format for banking clients and NCA-aligned format for entities under NCA jurisdiction. Executive summary suitable for regulatory submission.

Can the test be coordinated to avoid disrupting Hajj operations? Yes. KSA operational windows are part of scoping. Hajj, Ramadan, prayer times, end-of-fiscal-quarter — all factored.

What’s the typical remediation time after findings? Critical findings: 7-30 days expected (we re-test 90 days from initial report at the latest). High: 90 days. Medium: next quarterly cycle. Low: at next system change.

Does the engagement include re-test? Yes. Re-testing of remediated findings is included. Additional re-tests beyond first cycle are scoped separately.

How do you handle critical findings during the engagement? Immediately. If we find a critical-rated vulnerability mid-engagement (e.g., active exploitation evidence, unprotected sensitive data, ransomware staging), we notify your designated point of contact within hours, not at end-of-engagement.

Get a scoping call

Pen test scoping calls are 30-60 minutes and free. We’ll understand your environment, regulatory drivers, prior testing history, and recommend an appropriate engagement structure.

Request scoping call → contact form Sample report request → contact form