Penetration Testing
Take the depth-first next step: exploit validated weaknesses to prove real-world impact.
Learn moreAuthenticated and unauthenticated scanning across your estate, validated to remove false positives, then ranked by exploitability and business impact. A vulnerability assessment is breadth-first: it maximizes coverage so you know what exists, where penetration testing is depth-first and proves how far a real attacker could get.
A vulnerability assessment systematically scans the systems, services, and devices across your estate to identify known weaknesses: missing patches, insecure configurations, exposed services, and outdated components. The goal is breadth. We aim for the widest reliable coverage of your in-scope assets so that nothing material is left unexamined.
This is deliberately different from penetration testing. A vulnerability assessment is breadth-first and focused on coverage: it tells you what weaknesses are present across the whole estate. A penetration test is depth-first and focused on exploitation: it proves, through hands-on attack simulation, how far a determined adversary could actually progress. The two are complementary, and a clean vulnerability baseline is often the most cost-effective place to begin.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For a vulnerability assessment, that translates into the following steps.
Findings are anchored to recognized frameworks so they are defensible and cross-mappable.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
A vulnerability assessment is breadth-first: it scans widely to identify known weaknesses across your whole estate and tells you what exists. A penetration test is depth-first: a tester actively exploits weaknesses to prove how far a real attacker could progress. The assessment maximizes coverage, the pentest demonstrates impact. Many organizations use a vulnerability assessment to establish a baseline, then commission a penetration test on the highest-risk areas.
Unauthenticated scanning examines systems from the outside, the way an attacker without credentials would see them. Authenticated scanning uses credentials we agree with you to log in and inspect patch levels, installed software, and local configuration, which surfaces issues that external scanning cannot detect. We run both for the most complete and accurate picture.
For most organizations a recurring cadence, often quarterly, works well, with additional scans after significant infrastructure changes. Entities with continuous-assessment expectations under NCA ECC or ISO/IEC 27001 may run them more frequently. We help you set a cadence that fits your risk profile and obligations.
Yes, when it is planned properly. We agree scan windows, intensity, and any sensitive hosts with you in advance, tune the scanning to minimize load, and keep a point of contact available throughout. For especially fragile systems we can scan in lighter modes or against staging where appropriate.
Yes. The report, the executive summary, and the readout session are available in both Arabic and English at no additional cost.
Take the depth-first next step: exploit validated weaknesses to prove real-world impact.
Learn moreHarden the servers, networks, and configurations that recurring scans keep clean over time.
Learn moreGo beyond known weaknesses and proactively search the estate for signs of active intrusion.
Learn moreSeven factors that drive penetration testing effort, and how to compare proposals fairly.
Read the articleTell us about your estate and we will return a written proposal within five business days. NDA first, always.