ThagharatVulnerability Hunter
العربية

Penetration testing · Riyadh

We hunt down your vulnerabilities before attackers do.

Thagharat is a Saudi penetration testing company. Our testers work the way real attackers do and confirm every finding by hand, so your engineers get clear fixes and your compliance team gets audit evidence.

Message us on WhatsApp, opens in a new tabSee our services
  • Tested with OWASP and NIST SP 800-115 methods
  • Findings mapped to NCA ECC and SAMA CSF
90 days
To retest every confirmed finding, at no extra cost
5
Frameworks we map findings to
24h
Deadline to report a confirmed critical finding
2
Report languages: Arabic and English

What we do

Penetration testing that goes past the scanner

Automated scanners find the obvious issues. We look for what they miss: business logic flaws, chained exploits and misconfigurations that signatures do not detect.

Web application penetration testing

In-depth testing of authentication, session handling, access control, injection points and business logic. We also chain low-severity issues into the high-impact attack paths that scanners miss.

Learn more about Web application penetration testing
  • OWASP Top 10
  • Business logic
  • Auth bypass
  • Access control

Network & infrastructure testing

External perimeter and internal network assessments, Active Directory attack paths, lateral movement and privilege escalation to domain compromise, all carried out safely under agreed rules of engagement.

  • External network
  • Internal network
  • Active Directory
  • Lateral movement

Mobile application security

iOS and Android testing across the full stack: local storage, certificate pinning, IPC, reverse engineering resistance and the backend APIs the app depends on.

Learn more about Mobile application security
  • iOS
  • Android
  • OWASP MASVS
  • API layer

API & cloud security assessment

REST and GraphQL testing for broken object-level authorisation, mass assignment and missing rate limits, plus a review of cloud configuration across identity, storage and network boundaries.

Learn more about API & cloud security assessment
  • REST
  • GraphQL
  • BOLA / IDOR
  • Cloud config

Red teaming & social engineering

Objective-based adversary simulation that tests how well you detect and respond to an attack, not only what is vulnerable. Phishing campaigns, pretexting and physical access scenarios, scoped to what you want to measure.

  • Adversary simulation
  • Phishing
  • Detection testing

Compliance & GRC advisory

Readiness reviews and audit preparation for the frameworks you are assessed on. We turn technical findings into control-level evidence your compliance team can file. We do not issue certifications or carry out official compliance assessments.

  • NCA ECC
  • SAMA CSF
  • PDPL
  • ISO 27001
  • PCI DSS
Our method, deliverables and compliance mapping

Why Thagharat

What you can expect on every engagement

  • Experienced testers do the work

    Your systems are tested by experienced penetration testers. Tools speed up routine work such as sorting scanner output, but the testing, the judgement calls and every finding in your report come from a tester.

  • Every finding verified

    We report only what a tester has confirmed. Each finding comes with evidence and reproduction steps, so your engineers can check it themselves instead of chasing false alarms.

  • Reports in Arabic, English or both

    You choose the language of every deliverable, so the same report can serve Saudi regulators and your international partners.

  • Retest included

    We check your fixes. Every confirmed finding is retested once within 90 days at no extra cost, and a closure letter records the status of each one.

  • Critical findings within 24 hours

    If we confirm a critical finding, we tell your named contact within 24 hours, with enough detail to start fixing it. You do not have to wait for the final report.

  • Safety measures agreed in writing

    Destructive techniques are excluded unless you authorise them in writing. Testing in production follows agreed windows and stop conditions.

Questions

Before you get in touch

How long does a penetration test take?
A web application test typically takes one to three weeks from kick-off to report, depending on the number of roles, endpoints and business flows in scope. Network tests and red team engagements usually take longer. We confirm the timeline in the statement of work.
How much does a penetration test cost?
It depends on the scope: how many applications or hosts are involved, the roles and endpoints to test, the testing approach and the environment. Once we understand your environment, we send a fixed price for the agreed scope and a timeline. There is no hourly billing, and one retest is included.
Will testing disrupt our production systems?
We plan every test to avoid disruption. Before we start, we agree testing windows, request rates, stop conditions and an escalation contact, and you can pause or stop testing at any time. Destructive techniques such as denial of service are excluded unless you request and authorise them in writing.
What do we receive at the end?
Six deliverables, in Arabic, English or both. For leadership: an executive summary and a readout session. For engineers: a technical findings report with CVSS scores and reproduction steps, plus a remediation roadmap prioritised by risk and effort. For auditors: compliance mapping for the frameworks you report against and, after the retest, a closure letter.
Do you sign a non-disclosure agreement (NDA)?
Yes, always, and before you share any technical detail about your environment. We can sign your NDA template or provide ours. Engagement data is stored in Saudi Arabia for the retention period in your contract, then destroyed. You can ask us to destroy it earlier once the engagement ends, except records the law requires us to keep.
Do you use AI tools?
Our testers do the testing. Like most testing teams, we use tools to speed up routine work, and some of them are AI tools that help sort scanner output, review code, and draft and translate reports. Some of these tools are run by AI providers. Before anything is sent to them, we remove personal data, passwords, keys and tokens, and we only use providers that do not train their models on your data. If you prefer, we can agree in your statement of work not to use outside AI providers. A tester confirms every finding and reviews every report before you receive it.
Is retesting included?
Yes. One retest of all confirmed findings within 90 days of the report is included at no extra cost. After the retest you receive a closure letter recording the status of each finding, which you can share with auditors, clients or regulators.
Can you report against Saudi frameworks such as NCA ECC and SAMA CSF?
Yes. We scope and report against the frameworks you follow: NCA ECC, SAMA CSF and PDPL, as well as international standards such as ISO 27001 and PCI DSS. Each finding is mapped to the specific controls it affects, so your compliance team can use the report as audit evidence.

Get started

Tell us what you need tested

A few lines on what you want tested are enough, with no sensitive detail at this stage. We will reply with a proposed scope, a timeline and a fixed price. There are no sales calls and no obligation, and we sign an NDA before you share any technical detail.

Message us on WhatsApp, opens in a new tab

The fastest way to reach us. We aim to reply the same working day.

  • NDA before any technical detail
  • Fixed price for the agreed scope
  • One retest included

How we handle your details: Privacy Policy

Emailinfo@thagharat.comPhone+966 50 601 6914
Based inRiyadh, Saudi Arabia