03 · Testing
Penetration Testing & Cybersecurity Testing
Our engineers find and fix vulnerabilities before attackers do, for a strong defence against cyber threats.
What’s included
Penetration testing
- Full-spectrum testing, from reconnaissance through exploitation to reporting, across web, client-server, infrastructure, mobile, wireless and social engineering.
- Black-, grey- or white-box scopes, with commercial tools and custom scripts.
- Reports covering each gap, its impact and how to fix it.
Vulnerability assessments
- Automated scanning plus manual discovery across software, hardware and systems.
- Ongoing management to prioritise, patch and mitigate.
Application security testing
Threat modelling and testing of web and mobile apps, APIs, microservices and back ends for injection, XSS and broken authentication.
Social engineering testing
- Phishing, baiting and pretexting campaigns.
- Click-rate metrics and targeted follow-up training.
Red team operations
- Full-scope adversary simulations that test detection and response.
- Defences assessed against advanced persistent threats.
Compliance testing
- Testing that verifies compliance with regulations such as NCA and SAMA.
- Gap analysis and reporting that demonstrate adherence.
Types of penetration testing
- Web applications
- Websites, portals and web apps tested against the OWASP Top 10 and the OWASP Web Security Testing Guide: access control, injection, cross-site scripting, authentication, session handling and business logic.
- Mobile applications
- iOS and Android apps tested against OWASP MASVS: data storage, encryption, certificate pinning, reverse engineering and the APIs behind the app.
- APIs
- REST, SOAP and GraphQL tested against the OWASP API Security Top 10, including broken object-level authorisation and missing rate limits. Important for open banking.
- External network
- Internet-facing firewalls, VPNs, mail servers and exposed services, from an outside attacker’s point of view.
- Internal network
- An attacker who is already inside: Active Directory, privilege escalation, lateral movement and segmentation.
- Cloud
- AWS, Azure, Google Cloud and Saudi cloud platforms: storage, IAM roles, exposed keys and containers.
- Wireless
- Wi-Fi encryption, guest isolation and rogue access points.
- Red teaming
- A longer, goal-based simulation that tests people, process and technology together, with every action mapped to MITRE ATT&CK.
Black, grey or white box
| Approach | What the tester knows | Best for |
|---|---|---|
| Black box | Nothing beyond the target | Realistic view of an anonymous outside attacker |
| Grey box | A normal user account or limited information | Best balance of realism and coverage |
| White box | Architecture, source code and credentials | The deepest review, before launch or after major changes |
Our methodology
We follow PTES, the OWASP testing guides, NIST SP 800-115 and OSSTMM. Written authorisation is signed before any testing starts.
- 01Scoping
Targets, testing windows, rules of engagement and emergency contacts.
- 02Reconnaissance
Subdomains, technologies and exposed services.
- 03Threat modelling
The most valuable targets and likely attack paths.
- 04Vulnerability analysis
Automated scanning combined with manual review.
- 05Exploitation
Safely proving which weaknesses can be used, without damaging data or services.
- 06Post-exploitation
How far an attacker could go, such as sensitive data or domain admin.
- 07Reporting
Executive and technical reports.
- 08Retesting
We help your team fix issues and confirm they are closed.
What your report includes
- An executive summary in plain language, with overall risk and business impact
- Each finding with its CVSS score, affected assets, reproduction steps and evidence
- Remediation guidance written for developers and administrators
- Mapping to NCA ECC, SAMA CSF, PCI DSS and ISO 27001 controls
- A retest report you can show auditors and clients
What drives the cost of a penetration test
Price depends on effort: the number of applications, pages and API endpoints, the number of user roles, the number of IP addresses, the testing approach, the depth required and whether retesting is included. A single web application costs far less than a red team exercise. We give a fixed quote after a short scoping call.
Why CYBRT
Riyadh-based, Gulf-focused
Headquartered in Riyadh, working with organisations across Saudi Arabia and the Gulf.
Certified consultants
Our team holds CISA, CISM, CRISC, CGEIT, CDPSE, CCSP, CCSK, COBIT and ISO 27001 Lead Auditor certifications, among others.
Regulation-ready
We work with NCA and SAMA frameworks alongside ISO, NIST and PCI-DSS, so controls map straight to what auditors expect.
End to end
Six connected services, from strategy and awareness through testing, operations, cloud and technology.
Frequently asked questions
What can you penetration test?
Web applications, client-server applications, infrastructure, mobile, wireless and people through social engineering, in black-, grey- or white-box engagements.
How is a vulnerability assessment different from a penetration test?
A vulnerability assessment finds and prioritises weaknesses through scanning and manual review. A penetration test goes further and exploits them to show real-world impact, then reports how to fix each one.
Do you test against NCA and SAMA requirements?
Yes. Our compliance testing verifies adherence to regulations such as NCA and SAMA, with gap analysis and reporting you can share with auditors.
How often should we run a penetration test?
At least once a year, and after any major change such as a new application, a cloud migration, a large upgrade or a merger. PCI DSS requires internal and external tests at least annually and after significant changes.
Will testing affect our live systems?
We plan carefully to avoid disruption. Higher-risk actions are agreed in advance, and testing can run outside business hours or in a staging environment.
How long does a penetration test take?
A single web application usually takes five to ten working days. Network tests depend on size, and red team exercises can run for several weeks.
What do we need to prepare?
A list of targets, test accounts for grey-box testing, a technical contact and approval from the system owners.
Related services
Ready to protect your business?
Book your free security consultation today.