Your pentest report is not a security program.
The Attacker's View is a one-day workshop for leaders who sign off on penetration testing. Learn to commission it right, read it right and close findings fast — so every test turns into board-level assurance, not another PDF.
Request an in-house workshop
For organisations only. A CyberNAS advisor replies within one business day.
Request received
Thank you. A CyberNAS advisor will contact you within one business day to agree scope, date and language.
average cost of a data breach in the Middle East
IBM Cost of a Data Breach 2025NCA control requiring defined, approved and periodic penetration testing
NCA ECC-2:2024Dubai government entities may only buy pentests from certified providers
DESC · CRESTprofessionals trained by CyberNAS across 9 countries
CyberNASYou already pay for penetration tests. The problem is what happens around them.
Testing rarely fails technically. It fails at the leadership layer — scope, selection, prioritisation and follow-through.
Copy-paste scope
Last year's scope is reused, so new apps, cloud workloads and suppliers are never tested.
Scans sold as pentests
The cheapest bid wins and an automated scan arrives labelled "penetration test".
Unreadable reports
120 pages of CVSS scores that no one at the top can turn into a decision.
Findings that never close
No owners, no SLAs, no retest — the same issues reappear next year.
A PDF, not evidence
When the regulator asks, there is a report — but no program behind it.
Regulators no longer ask whether you test. They ask how you govern it.
Control 2-11: Penetration Testing
Requirements must be defined, documented and approved, implemented, cover at least all externally provided services, run periodically and be reviewed periodically.
NCA Essential Cybersecurity ControlsAnnual tests for the financial sector
Customer- and internet-facing services of SAMA-regulated institutions should be subject to annual review and penetration testing.
SAMA Cyber Security FrameworkSAR 27M per breach
The average breach cost in the Middle East — rising to SAR 34M in financial services. Leadership owns that risk.
IBM Cost of a Data Breach 2025Security testing is a required control
The UAE Information Assurance Regulation (v1.1) expects vulnerability management and security testing, including penetration testing, from government and critical-sector entities.
TDRA UAE IA Regulation v1.1Only certified providers in Dubai
Since mid-2024, Dubai government, semi-government and critical-infrastructure entities must buy penetration testing from Cyber Force-certified providers. Choosing a vendor is now a compliance decision.
Dubai Electronic Security Center · CRESTFederal Decree-Law 45/2021
The UAE data protection law expects appropriate security measures for personal data. Tested, governed controls are your evidence.
Federal Decree-Law No. 45 of 2021Built for the people who sign off — not the people who type commands.
No laptops and no jargon. Hands-on testers should ask us about our SANS Institute academies instead.
After one day, your leaders will be able to:
- 1Explain what VA, pentest, red team, BAS and bug bounty each prove — and which to buy when.
- 2Write a scope and rules of engagement that satisfy NCA, SAMA, UAE IA and DESC expectations.
- 3Select providers with an objective scorecard and spot scan-sold-as-pentest red flags.
- 4Read a pentest report in 15 minutes and rank findings by business risk.
- 5Drive remediation to closure with SLAs, retests and board-ready KPIs.
- 6Leave with a 12-month VAPT calendar and a 90-day action plan.
Seven modules. One decision-ready leadership team.
Tailored to your sector and regulator before delivery.
Why VAPT is a board issue
Breach economics, regulatory duties and leadership accountability.
45 minutes in the attacker's chairLIVE
Our testers run a real attack chain on a lab replica. You watch the decisions, not the commands.
Buying the right test
VA vs pentest vs red team vs BAS vs bug bounty; depth and frequency by asset criticality.
Scoping, rules of engagement & vendor selection
The one-page Scoping Canvas and vendor scorecard. Exercise: scope your own crown jewels.
Reading the report like an executive
From CVSS to business impact. Tabletop: 12 findings, one budget, one quarter — what do you fix first?
From findings to closure
Remediation SLAs, ownership, retesting, risk acceptance and the KPIs that matter.
A regulator-ready VAPT program
12-month calendar, evidence pack and board dashboard — plus your 90-day plan.
See your organisation the way an attacker does.
One attack path, four leadership decisions. Every step maps to a question your leaders will learn to ask.
Public footprint
Forgotten subdomains, exposed services and leaked data found from the internet alone.
"Is our scope as big as our real attack surface?"
Initial foothold
An unpatched, internet-facing system becomes the way in.
"How fast do we close critical findings?"
Credential reuse
One weak password opens many doors inside the network.
"Did our last test go beyond the perimeter?"
Data access
Customer data reached — the moment it becomes a regulatory event.
"Would we have detected it, and could we prove it?"
Leave with the templates, not just the theory.
Scoping Canvas
Your full attack surface on one page.
Rules of Engagement
Authorisation and safety template.
Vendor Scorecard
Plus an RFP checklist.
Remediation SLA Matrix
Critical to low, with owners.
Board Dashboard
MTTR, closure rate, coverage.
12-Month Calendar
What to test, and when.
Regulatory Evidence Checklist
NCA, SAMA, UAE IA and DESC mapped.
External Exposure Snapshot
Optional: an authorised look at your own internet footprint.
Delivered privately, for one organisation at a time.
Taught by people who run penetration tests for a living.
- Our consultants deliver penetration testing, red teaming and incident response across the GCC.
- GIAC, OSCP, CISSP, CISM and CEH-certified experts.
- Content calibrated to NCA, SAMA, TDRA and DESC requirements — not imported slides.
- Offices in Riyadh and Dubai, with delivery in Arabic and English.
Questions leaders ask us
Is the workshop technical?
No. There are no laptops or commands. It is designed for decision-makers, and the live demo is narrated in business language.
Can it be tailored to our sector?
Yes. The regulatory module and the tabletop exercise are adapted to your sector (banking, government, healthcare, energy, telecom) and your country before delivery.
Will you test our systems during the workshop?
The live demo runs on a lab replica, never on your systems. The optional External Exposure Snapshot uses only public information and requires your written authorisation. A full penetration test is a separate engagement.
Can it be delivered in Arabic?
Yes — in Arabic, English or bilingually, depending on your team.
Is there an open public session?
No. The workshop is delivered privately for one organisation at a time, so your leaders can discuss real risks openly.
Your next penetration test should be your best one.
Book a private cohort for your leadership team in Saudi Arabia or the UAE.