Web Application Testing
Manual and tool-assisted testing of web applications against the OWASP testing methodology, covering authentication, access control, injection, and business logic.
Learn moreProtect payment card data and pass your PCI DSS assessment with less effort. We help you shrink the scope, close the gaps and prepare the evidence for your Qualified Security Assessor or self-assessment.
The Payment Card Industry Data Security Standard (PCI DSS) applies to every organization that stores, processes or transmits payment card data, or that can affect its security. It is maintained by the PCI Security Standards Council, and version 4 is the current standard.
PCI DSS covers network security, protection of card data, vulnerability management, access control, monitoring and testing, and security policy. The single biggest lever is scope: the fewer systems touch card data, the smaller and cheaper compliance becomes.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For this engagement, that translates into the following steps.
Findings are anchored to recognized frameworks so they are defensible and cross-mappable.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
No. Formal PCI DSS assessments are carried out by Qualified Security Assessors. We prepare you so that the assessment, or your self-assessment, goes smoothly.
Often, yes. Tokenization, hosted payment pages and network segmentation can remove many systems from scope.
Card payments are governed by the card schemes and your acquiring bank, and PCI DSS sits alongside SAMA's own requirements for regulated entities. We map both where relevant.
Yes. Reports, the executive summary, and the readout session are available in both Arabic and English at no additional cost.
Manual and tool-assisted testing of web applications against the OWASP testing methodology, covering authentication, access control, injection, and business logic.
Learn moreCompliance programmes against the SAMA Cyber Security Framework for entities regulated by the Saudi Central Bank.
Learn moreAuthenticated and unauthenticated scanning across your estate, ranked by exploitability and impact.
Learn moreHow card data flow sets your scope, what version 4 changed, and eight steps for merchants.
Read the articleTell us how you take payments and we will return a written proposal within five business days. NDA first, always.