Applications
- Web applications
- Mobile applications
- APIs
Penetration Testing & Red Teaming
We find the weaknesses attackers would use — in your applications, infrastructure and people — and show you how to close them, by certified testers based in the Kingdom.
Last reviewed:
What is this service?
Penetration testing validates whether weaknesses in an authorised scope can be exploited and what impact that creates. Red teaming uses agreed adversary objectives to examine attack paths and defensive response across a wider scenario. They answer related but different questions. JODOR agrees the assets, permissions, safety boundaries and reporting expectations before any testing begins, including how sensitive evidence will be handled.
Who needs it?
Testing is useful before releasing important applications, after significant changes and when assurance is needed for critical environments. Red teaming suits organisations with established controls and defenders ready to learn from an adversarial scenario. The scope must reflect production sensitivity, third-party permissions and business priorities rather than simply maximise the number of tested addresses.
TECHNOLOGY ALLIANCES
Technologies we deploy for this service
What we cover
Scope options
Infrastructure
- Internal network
- External network
- Cloud infrastructure
Red team simulation
- Adversary emulation
- Social engineering
- Physical security testing
How we deliver
Delivery starts with an agreed scope, named asset owners, access permissions, evidence requirements and a communication plan. For this service, the discussion includes Web applications, Mobile applications, APIs, Internal network. Observations are connected to their source and business context, and assumptions are checked with the relevant owners. Work outside the agreement is raised explicitly rather than silently added. Review points and escalation arrangements help your team understand what has been completed, what remains uncertain and which actions depend on information or authorisation from you.
01
Scope
Objectives, rules of engagement and a fixed timeline.02
Test
Manual and tool-assisted testing by certified testers.03
Report
Risk-rated findings, attack paths and a fix plan.04
Retest
We confirm each fix and close the finding.Deliverables
Deliverables connect the findings to the agreed business objective rather than simply export tool output. Recommendations identify rationale, relative priority, proposed ownership and dependencies on other teams or technologies. We distinguish verified observations from items requiring further evidence, and explain limitations that affect confidence. Sensitive material is handled under the agreed arrangements. A readout gives your team an opportunity to challenge conclusions and clarify next steps. Implementation, retesting and continued oversight are included only where the proposal explicitly defines them.
- Executive summary for management
- Technical report with evidence and severity
- Remediation plan in priority order
- Retest letter once fixes are confirmed
Timeline
Timing is agreed after scoping and checking evidence readiness, system access and stakeholder availability. A bounded assessment may take several weeks; implementation or ongoing support needs a separate phased plan. The proposal identifies assumptions, dependencies and review points. Changes to assets, permissions or access can change the schedule. An indicative duration is not a universal delivery promise or a substitute for confirming your actual environment.
Frequently asked questions
Can testing disrupt production systems?
Any intrusive testing can carry operational risk. We agree rules of engagement, prohibited techniques, test windows, emergency contacts and stop conditions before starting. High-risk actions may require a representative non-production environment or explicit additional permission. No provider should promise that testing is risk-free. Your asset owners must authorise the scope and understand the proposed methods and residual risks.
What should we prepare before the engagement?
Prepare asset and service ownership details, relevant policies, available records and an approved way to share evidence. We discuss Web applications, Mobile applications, APIs, Internal network. Access must be authorised before any intrusive or privileged activity begins. Missing information is recorded as a limitation and prioritised with your team, rather than automatically interpreted as proof that a control either exists or has failed.
How does the team turn findings into practical actions?
Findings should connect the observation, relevant risk and required control to a proposed owner and verifiable outcome. Management resolves competing priorities and decides whether to treat or accept risk within its authority. Closing a ticket alone does not prove that an issue has been removed. We explain suitable verification, with retesting or continued tracking included only when explicitly agreed in scope.
How long does delivery take, and is the schedule guaranteed?
Timing is agreed after scoping and checking evidence readiness, system access and stakeholder availability. A bounded assessment may take several weeks; implementation or ongoing support needs a separate phased plan. The proposal identifies assumptions, dependencies and review points. Changes to assets, permissions or access can change the schedule. An indicative duration is not a universal delivery promise or a substitute for confirming your actual environment.
Does this service guarantee compliance or prevent every incident?
No. The service supports assessment, improvement and evidence within an agreed scope; it cannot prevent every incident or confer regulatory approval. Applicable obligations depend on your activities, supervising authority and the requirements in force. Management retains responsibility for implementation, risk decisions and any formal submission. We describe what was and was not assessed so that a scoped finding is not mistaken for an organisation-wide guarantee.
Related services
Explore SAMA regulatory compliance guidance for this service
Request a proposal
Fill out the form and we'll get back to you soon
We reply within one business day.