Cybersecurity Risk Assessment Services in Saudi Arabia
Find out what is actually unpatched, unmanaged and unmonitored across your estate — and how your people behave under a real phishing test. A technical assessment from Blue Edge in Dammam, delivered in days rather than months.
A technical assessment — not a compliance audit
Two very different things get sold under the words "cybersecurity risk assessment" in the Kingdom, and buyers routinely commission the wrong one. Here is the honest split.
Audit work — months, not days
Examines your governance, policy set, risk methodology, contracts and technical controls against every applicable control, produces a scored position and prepares your NCA submission.
- Takes months and needs qualified independent assessors
- Covers governance, HR, third-party and resilience controls
- Blue Edge does not do this — be wary of any supplier who claims to
What this page is about
Answers a narrower question: what is actually running on your estate right now, what is unpatched, what is unmanaged, and how your people behave when a phishing email arrives.
- Takes days and costs nothing to start
- Runs through lightweight agents and a controlled phishing test
- Produces the technical evidence the bigger assessment asks for anyway
Four questions, answered with evidence
Almost every organisation we assess is confident about two of these and wrong about at least one. The assessment is deliberately narrow — we would rather answer four questions properly than produce a hundred-page document nobody acts on.
Discovery runs through lightweight agents and a controlled phishing test. No appliance to install, no network taps, no disruption to production.
What do you actually own?
A full inventory of endpoints, servers and installed software. Most estates contain devices nobody has looked at in years and software nobody knew was there.
What is exposed?
Installed versions correlated against current CVE data, ranked by severity. Third-party applications are where the surprises usually are, not the operating system.
How fast do you patch?
Actual patch latency across the estate, and how many machines sit outside any patching policy at all. This is the number that decides how bad a bad day gets.
How do your people behave?
A baseline phishing simulation across the workforce, giving your real click rate by department and role rather than a global average.
Where the findings sit against NCA ECC
The current framework is ECC-2:2024 — four domains, 28 subdomains, 108 main controls. The findings below map to control areas within the Cybersecurity Defence and Governance domains. The subdomain numbering for these areas is unchanged from ECC-1:2018.
| ECC subdomain | What an assessor looks for | What this assessment gives you |
|---|---|---|
| 2-1 Asset Management | A complete, maintained inventory of technology assets with ownership assigned | A discovered inventory of every endpoint and server, with installed software — usually the first time the real number is visible |
| 2-3 Information Systems Protection | Endpoint protection deployed and patch management operating to defined SLAs | Coverage gaps, unmanaged devices, and measured patch latency across the estate |
| 2-10 Vulnerability Management | Regular scanning, risk-rated findings, remediation within SLA | A ranked CVE exposure list tied to the specific patches that resolve each finding |
| 1-10 Awareness and Training | An awareness programme reaching all personnel, with phishing simulation results | A measured baseline click rate by department, which is the starting evidence for the programme |
| 2-6 Mobile Devices Security | Managed and secured mobile devices accessing organisational resources | Visibility of which mobile and remote devices are enrolled and which are not |
Key takeaway: this covers technical evidence within five subdomains out of 28. It is a starting position, not a compliance verdict. If someone tells you a tooling assessment makes you ECC compliant, they have not read the framework — governance, policy, HR, third-party and resilience controls are entirely outside what any scan can see.
Four stages, roughly two weeks
No appliance, no network taps, no production downtime.
Scope and permissions
We agree what is in scope, who authorises the work in writing, and which systems are off limits. Nothing starts without that.
Deploy and discover
Lightweight agents go onto a representative sample or the full estate. Inventory and vulnerability data start arriving within hours.
Baseline the human layer
A controlled phishing simulation runs across the workforce, with allow-listing configured first so the result reflects reality rather than your mail filter.
Report and walk through
Findings presented in a session with your IT and security people, not emailed as a PDF nobody opens. Every finding comes with what fixes it.
On the free assessment. The baseline phishing test costs nothing — it uses a free tool from KnowBe4. The endpoint discovery runs on a trial deployment. If the results come back healthy, we will say so. A report that manufactures urgency to justify a quotation is worth nothing to either of us.
What we do not do, and who you need instead
Knowing where a supplier stops is more useful than a list of everything they claim.
Penetration testing
The ECC penetration testing controls require periodic testing by competent, authorised testers. We can tell you what is exposed; we do not simulate an attacker exploiting it.
Independent ECC audit
Subdomain 1-8 calls for independent review and audit. A supplier who also sells you the remediation tooling is not independent. Keep the two roles separate.
Governance and policy work
Strategy, risk methodology, policy sets, RACI and third-party contract clauses are consulting work. An independent cybersecurity function staffed by qualified Saudi professionals is your build, not ours.
A compliance certificate
Nothing here produces one. ECC compliance is assessed by the NCA through self-assessment, its compliance tool and field audits — not by a vendor report.
Every finding comes with the thing that fixes it
The reason most assessment reports change nothing is that they end at the diagnosis. Ours does not, because the same platforms that produced the findings also close them — and we will be explicit that we supply those platforms, so you can weigh the recommendation accordingly.
You are free to take the findings and remediate with someone else. The report is yours either way.
Sectors we work with in the Kingdom
ECC obligations cascade contractually. A private company hosting, processing or supplying services to a government or critical national infrastructure entity is typically required through contract clauses to meet the relevant controls for those systems — even where the NCA has not named it directly.
If any of your Saudi public-sector clients handle national or critical data, assume exposure. The organisations that come to us are usually reacting to a contract clause rather than a regulator.
Energy, petrochemical and industrial
Eastern Province operators with large mixed estates and long-lived equipment.
Construction and contracting
Distributed sites, high staff turnover and heavy procurement email traffic.
Financial services
Organisations carrying SAMA Cyber Security Framework obligations alongside ECC.
Healthcare and education
Large user populations, tight budgets and significant personal data holdings under PDPL.
Government suppliers
Private firms with ECC requirements written into their contracts.
Start with the free baseline
The phishing baseline costs nothing and takes a few days. Endpoint discovery runs on a trial deployment. You get your real numbers before any money changes hands — and if they come back healthy, we will tell you that rather than sell you a programme you do not need.
Cybersecurity risk assessment — common questions
-
Does this make us NCA ECC compliant?
No. ECC-2:2024 contains 108 main controls across 28 subdomains covering governance, policy, human resources, third-party arrangements, resilience and technical defence. A technical assessment produces evidence for a handful of the defence subdomains. It is a useful starting position and it gives you real numbers, but compliance is assessed by the NCA through self-assessment, its compliance tool and field audits.
-
Is the assessment really free?
The baseline phishing test is free — it uses a no-cost tool from KnowBe4 that runs a simulated campaign without a subscription. Endpoint discovery runs on a trial deployment, which is also free for the trial period. What we are hoping for is that the findings lead to a remediation conversation. If they do not, you keep the report.
-
How long does it take?
Roughly two weeks end to end for a mid-sized estate. Agent deployment and inventory produce useful data within hours; the phishing baseline needs a few days to run properly; the reporting session follows. A formal ECC gap assessment by an audit firm is a different order of magnitude — typically months.
-
Will it disrupt our systems?
No. Discovery uses lightweight endpoint agents that report inventory, with the correlation work happening off the device. There is no scanning appliance, no network tap and no production downtime. Scope and authorisation are agreed in writing before anything is deployed.
-
Do you do penetration testing?
No. The ECC penetration testing controls require testing by competent, authorised testers, and that is a specialist engagement rather than something a technology supplier should bolt on. A vulnerability assessment tells you what is exposed across the estate; a penetration test demonstrates what an attacker could do with it.
-
Which version of the ECC applies to us?
ECC-2:2024 is the current edition, with four domains, 28 subdomains and 108 main controls. It revised ECC-1:2018 while keeping the overall architecture — the subdomain numbering in the Governance and Defence domains is unchanged. Check which edition your contract or regulator names, and take the official NCA publication as authoritative over any commentary, including ours.
-
We are a private company. Does ECC apply to us?
Directly, the ECC applies to government entities, their affiliates, and private organisations that own, operate or host critical national infrastructure. In practice obligations cascade through contracts: a private company supplying services to a government or CNI entity is usually required to meet the relevant controls for those systems. If your Saudi public-sector clients handle national or critical data, assume exposure and check your contract wording.
-
Are you independent if you also sell the fix?
No, and we will not pretend otherwise. We supply the platforms that close most of what the assessment finds, so we have a commercial interest in the outcome. That is exactly why the ECC periodical review and audit controls ask for independent review from someone with no such interest. Use this to get your technical facts quickly and cheaply; use a qualified assessment firm for the independent opinion.
Talk to Blue Edge about your estate
Blue Edge has always embraced our clients and partners as part of our team. Every project is performed with open communication, and a mutual respect with our clients provides the groundwork for our success.
Tell us roughly how many endpoints and staff you have, and what is prompting the question — a contract clause, an audit date, or something that already went wrong. We will tell you whether a technical assessment is the right first step or whether you need an audit firm.