We run managed cybersecurity for companies in Jeddah and the western region, combining day-to-day protection with readiness for compliance. It is built for leadership teams who need clear answers to two questions: are our systems actually protected, and can we prove it when someone asks? You get one accountable team, 24/7 monitoring, and a written service level agreement in every contract.

When you need this

  • A regulator, a government client or a large customer has asked you to demonstrate alignment with the National Cybersecurity Authority's Essential Cybersecurity Controls
  • Nobody can say for certain who holds administrator rights, or when they were last used
  • Security updates get applied when someone remembers, not on a known schedule
  • There are no central logs to go back to when something goes wrong
  • You hold personal data on customers or staff and want to be ready for the Personal Data Protection Law
  • There is no written plan for who does what if you are hit by ransomware or a data leak

If two or more of these sound familiar, your real exposure is probably higher than current reports suggest. Many incidents don't start with a sophisticated attack — they start with an account without MFA, an unpatched server, or access that was never removed when someone left.

What's included

We use the Essential Cybersecurity Controls as the reference framework and apply what fits your size and line of business, so compliance becomes how you operate rather than a binder prepared once and forgotten.

  • Gap assessment: your current state measured against the Essential Cybersecurity Controls, with gaps ranked by risk and effort.
  • Hardening: secure configuration of servers, endpoints and network, and removal of anything that doesn't need to be exposed.
  • MFA and privileged access: multi-factor authentication on email and critical systems, and a controlled, regularly reviewed list of admin accounts.
  • Patch management: a defined schedule for operating system and application updates, tested before wide rollout.
  • Logging and monitoring: centralized logs watched around the clock, with alerts on the events that matter.
  • Incident response plan: written roles, communication channels and containment steps, rehearsed in a tabletop exercise.
  • Security awareness: short, practical sessions for staff on phishing, passwords and suspicious attachments.
  • Audit evidence: organized documentation for every control in place, ready for an auditor or a customer's security review.

How we work

  1. Assessment: we inventory assets, accounts and exposed systems, compare them with the required controls, and hand you a prioritized gap report.
  2. Remediation plan: we agree the order and timing of fixes so the business keeps running, starting with the quickest risk reducers: access rights, MFA and backups.
  3. Managed operation: we handle monitoring, patching, access reviews and alert response continuously, under the written SLA.
  4. Monthly review: we walk you through the gaps closed, the events detected, and the decisions that need management input.

What you receive

  • A written SLA that sets out response times and responsibilities
  • An initial gap report, then a monthly report on control status and security events
  • Access to our client portal to follow tasks, tickets and documents
  • A project group in the portal, bridged to WhatsApp, where monitoring alerts land directly
  • A written, up-to-date incident response plan
  • An organized compliance evidence file you can hand to an auditor

Transparency is built into the service, not added on top: every alert, ticket and configuration change is logged in the portal, so your management can see what happened, when, and who handled it — without waiting for the month-end report. If you are preparing for an audit, our guide to cybersecurity audit readiness is a useful starting point.

Frequently asked questions

Does this replace an in-house security team?

For many mid-sized companies, yes: we run the controls, monitoring and response day to day. If you already have internal staff, we work alongside them and agree in writing who owns what, so nothing falls between the cracks.

Can you guarantee we will pass an NCA audit?

No provider can honestly guarantee an audit outcome. What we commit to is that the controls are genuinely in place and that the evidence is documented, organized and ready when the auditor asks for it.

Does the service cover the Personal Data Protection Law (PDPL)?

We cover the technical side: mapping where personal data lives, restricting access to it, encryption, logging and breach-handling procedures. The legal side we coordinate with your legal advisor.

What happens if an incident occurs outside business hours?

Monitoring runs 24/7. The alert reaches our team and your project group in the client portal, which is bridged to WhatsApp, and we start the agreed response plan within the response times written into your agreement.

How long does the initial assessment take?

It depends on the size of your environment, the number of systems and branches. We set the timeline after a short discovery call and commit to it in writing before we start. The initial assessment is free.