Cyber Shields was established in May 2025 in Riyadh, Kingdom of Saudi Arabia. The practice was founded on a single observation: Saudi organizations deserve cybersecurity advisory that is delivered in their language, anchored in the standards their regulators enforce, and led by practitioners, not by template reports authored in another time zone.
A Kingdom in which every organization, from the family-owned enterprise to national infrastructure, operates from a defensible and audit-ready cybersecurity posture, delivered in Arabic and English, on Saudi terms.
مملكةٌ يعمل فيها كل كيان من منشأةٍ صغيرة إلى بنية تحتية وطنية انطلاقًا من وضع أمن سيبراني قابل للدفاع والتدقيق، بالعربية والإنجليزية، وعلى الشروط السعودية.
To deliver governance, offensive, and defensive cybersecurity under a single registered practice, measured against the frameworks that Saudi authorities actively enforce: NCA ECC, NCA DCC, SAMA CSF, the Personal Data Protection Law, and ISO/IEC 27001.
تقديم الحوكمة والأمن الهجومي والدفاعي تحت سقف واحد، وفق المعايير التي تطبّقها الجهات التنظيمية في المملكة فعليًا.
The Cyber Shields mark is not decorative. It encodes the three disciplines that every cybersecurity programme must balance, unified by the governance lock that holds them together.
The attacker's perspective. Penetration testing, vulnerability assessment, and compromise assessment: finding what adversaries would exploit before they do.
The regulator's perspective. GRC: ECC, ISO/IEC 27001, SAMA CSF, PDPL, DCC. Policy, process, evidence, control coverage.
The defender's perspective. DFIR, threat hunting, hardening, and awareness: operational security that holds the line when prevention fails.
The padlock at the top of the shield represents the unifying discipline: governance that ties offensive and defensive work into a coherent, auditable security programme.
Every Cyber Shields engagement follows the same three-phase rhythm. Regardless of the service, the client always knows where the engagement stands.
Scope, NDA, kick-off. Then technical and policy review: gap against the relevant standard, evidence collection, asset and risk inventory. You receive a clear, prioritized findings register.
Remediation roadmap with timelines, owners, and acceptance criteria. We can advise, validate your team's work, or implement directly. Every fix maps back to a finding and a control.
Ongoing assurance: recurring assessments, threat hunts, awareness refreshers, control re-tests. Security posture is not a project, it is a programme.
Every reference number below is verifiable with its issuing authority. They are published in full, so no client must request them.
| Authority | Type | Reference |
|---|---|---|
| Ministry of Commerce | Commercial Register | 7050439160 |
| National Cybersecurity Authority (NCA) | Cybersecurity Services License | Active |
| Communications, Space & Technology Commission (CST) | IT Services Registration | Active |
| Monshaat (General Authority for SMEs) | SME Certificate | 26160311250 |
| National Address | Building National Address | RIUC6591 |
Clients communicate directly with senior practitioners. There is no intermediary salesperson, and no offshore handoff.
Tech Co-Founder · Lead Practitioner
A published cybersecurity researcher with field experience across offensive, defensive, and governance engagements in the Saudi market. Responsible for technical delivery and methodology across every Cyber Shields engagement.
View on LinkedIn
