Thagharat is a penetration testing practice built on manual, evidence-driven work. We attack your systems the way a real adversary would — then hand you a report your engineers can act on and your auditors will accept.
Certified by eLearnSecurity · INE · OCEG
Automated tools find the obvious. We are hired for everything underneath it — business logic, chained exploits, and the misconfigurations no signature catches.
Full-depth assessment of authentication, session handling, access control, injection surfaces and business logic. We chain low-severity issues into the high-impact paths a scanner will never report.
External perimeter and internal network assessments, Active Directory attack paths, lateral movement, and privilege escalation to domain compromise — executed safely, under agreed rules of engagement.
iOS and Android testing across the full stack: local storage, certificate pinning, IPC, reverse engineering resistance and the backend APIs the app depends on.
REST and GraphQL testing for broken object-level authorization, mass assignment and rate-limit failures — alongside cloud configuration review across identity, storage and network boundaries.
Objective-based adversary simulation that tests detection and response, not just vulnerabilities. Phishing campaigns, pretexting and physical access scenarios, scoped to what you actually want measured.
Gap assessments and readiness work mapped to the frameworks your regulator audits against. We translate technical findings into control-level evidence your compliance team can file.
Every engagement runs the same disciplined path. You always know what stage we are at, what we have found, and what happens next.
We agree targets, testing windows, escalation contacts and hard boundaries in writing before a single packet is sent. NDA signed up front.
Attack surface mapping and threat modelling against your actual business risk — so effort goes where a real attacker would concentrate it.
Findings are proven, not guessed. Each one is manually exploited and captured with a reproducible proof of concept. No unverified scanner noise reaches your report.
An executive summary your board can read, and a technical section your engineers can act on. CVSS-scored, mapped to remediation steps and framework controls.
After you fix, we verify. A retest of all confirmed findings is included, with a clean closure letter you can hand to auditors or clients.
The same six deliverables on every engagement, in Arabic and English — for the engineers who fix, the leaders who decide and the auditors who check.
Your risk in business terms: what is exposed, how serious it is and what to fix first. Written for leadership and the board.
Every finding with its CVSS rating, affected assets, evidence and step-by-step reproduction, so your engineers can confirm it themselves.
Fixes prioritised by risk and effort, with concrete guidance for your stack rather than generic advice.
Each finding mapped to the controls it affects in NCA ECC, SAMA CSF, PDPL, ISO 27001 and PCI DSS — ready to file as audit evidence.
A walkthrough of the results with your engineers and leadership, where we answer questions and agree next steps.
Once you have fixed the findings we verify them, then issue a closure letter for auditors, clients or regulators.
Attestation and closure letters carry a unique ID. Anyone — your auditor, your client, a regulator — can confirm on our site that a letter is genuine.
Tooling accelerates discovery; it never replaces judgement. The findings that matter come from a human reading your application logic.
If we report it, we exploited it. Every finding ships with reproduction steps and evidence, so your team never wastes a sprint chasing a phantom.
Full deliverables in Arabic and English. The same report satisfies a local regulator and an international parent company.
Remediation verification is part of the engagement, not a change order. You get a closure letter when the findings are confirmed fixed.
Anything critical is escalated the moment it is confirmed. You do not wait for the final report to learn your perimeter is open.
Destructive techniques stay out of scope unless you explicitly authorise them. Production testing follows agreed windows and abort conditions.
Thagharat — صائد الثغرات, “the vulnerability hunter” — is a penetration testing company based in Riyadh. It was founded by offensive security practitioners with more than nine years of hands-on experience testing web applications, networks and mobile apps.
We keep the practice deliberately focused: manual testing, proof for every finding, and reports that work for engineers, auditors and regulators alike — in Arabic and English.
We test the way attackers operate because that is the work we come from — not a checklist exercise.
Findings mapped to NCA ECC, SAMA CSF and PDPL, with deliverables your regulator and your engineers can both use.
An NDA before any technical detail, minimal data access during testing, and engagement data destroyed on request.
Nine years of hands-on offensive security, backed by certifications on both sides of the table — the people who break systems, and the people who audit them.
A penetration test is only half the deliverable. We map every finding to the control it breaks, so the report doubles as compliance evidence.
Technical testing aligned to NCA ECC control domains, with findings mapped to the specific controls they affect.
Assessment support for financial institutions operating under the SAMA framework and its maturity expectations.
Review of how personal data is stored, transmitted and exposed across your applications and interfaces.
Annex A control testing and evidence packages that fit directly into your ISMS documentation and audit cycle.
Segmentation testing and application assessments meeting Requirement 11 penetration testing obligations.
Engagements follow OWASP WSTG and MASVS, with reporting structured around the NIST SP 800-115 methodology.
We don't bill by the hour. Tell us about your environment and we come back with a fixed price for the agreed scope, a timeline and a statement of work — no open-ended billing.
How many applications, domains, IP addresses or hosts are in scope.
The user roles, API endpoints and business flows that need to be exercised.
Black-box, grey-box with credentials, or white-box with access to source code.
Production or staging, and any testing windows your operations require.
Whether findings must be mapped to NCA ECC, SAMA CSF, PDPL, ISO 27001 or PCI DSS.
Standard scheduling, or an expedited start when a deadline is close.
Send a short description of your environment and we will come back with a scope, timeline and fixed price. No sales calls, no obligation, and an NDA before any technical detail is shared.
Fastest route — usually answered same day