Locations · Saudi Arabia

Working with Saudi teams, by the Kingdom’s rules.

We have no office in Saudi Arabia. From Bengaluru, two and a half hours ahead of Riyadh, we help Saudi companies test their AI and get ready for the NCA’s controls and the data protection law, and we are upfront about which work must go to NCA-registered providers.

Ask about a Saudi project What we can take on
No Saudi office: served from BengaluruFour shared working daysECC-2:2024 and PDPL covered
In plain words

HanulSec helps companies in Riyadh, Jeddah and across Saudi Arabia from Bengaluru, India, two and a half hours ahead of Riyadh, and we share four working days a week, Monday to Thursday. Our focus is AI red teaming and readiness for the NCA’s Essential Cybersecurity Controls and the Personal Data Protection Law. Cybersecurity providers working in the Kingdom must register with the NCA, and managed SOC services need an NCA licence. We are not NCA-registered, so where a project needs a registered provider, we support that provider or your own team.

Checked against official sources on . General information, not legal advice.

Time difference
India is 2½ h ahead
Shared days
Monday to Thursday
Office
None: served from Bengaluru
Saudi rules
NCA ECC, PDPL, SAMA
Working together

Four shared days, 6½ shared hours.

Saudi Arabia works Sunday to Thursday and India Monday to Friday, so we overlap Monday to Thursday. A 9-to-6 day in Riyadh starts two and a half hours after ours.

India works Monday to Friday and Saudi Arabia Sunday to Thursday, so four working days are shared, Monday to Thursday. In India time, a 9-to-6 day in Riyadh runs from 11:30 to 20:30, sharing six and a half hours with a 9-to-6 day in Bengaluru. THE WORKING WEEKMONTUEWEDTHUFRISATSUNINDIAOFFOFFSAUDI ARABIAOFFOFF4 DAYSSHARED EACH WEEKMonday to ThursdayINDIA TIME →06:0009:0012:0015:0018:0021:0000:0003:0006:00INDIAUTC+5:30 · OUR OFFICEOUR DAYSAUDI ARABIAUTC+3 · 9 TO 6 LOCAL6½ H SHARED
The Saudi weekend is Friday and Saturday. On Sundays our 24/7 incident line is there for emergencies, and everything else is picked up first thing Monday.
An honest fit

What we take on, and what we don’t.

What we take on

Where your rules allow a provider based outside the Kingdom

  • AI red teaming of chatbots, voice agents and AI agents
  • Readiness for ECC-2:2024 and the PDPL, working with your Saudi cybersecurity team
  • ISO 27001 and ISO 42001 readiness
  • Planning for the October 2026 draft PDPL changes

What goes to others

Where Saudi rules point elsewhere

  • Managed SOC for government and critical infrastructure, which needs a Tier 1 NCA-licensed provider
  • Work that must go to an NCA-registered provider: we support that provider instead
  • Cybersecurity roles inside your organisation, which ECC-2 reserves for Saudi professionals
The rules

Saudi rules we prepare you for.

Questions

Saudi questions, answered.

Q01Do you have an office in Saudi Arabia?
No. We work from Bengaluru, India, two and a half hours ahead of Riyadh. We share Monday to Thursday as working days, and our 24/7 incident line on +91 0080887899 answers at any hour.
Q02Do cybersecurity providers need NCA registration?
Yes. Since 1 August 2022, any entity that provides cybersecurity services, solutions or products in the Kingdom must register on the NCA’s platform. Managed SOC services also need an NCA licence: Tier 1 to serve government entities, Tier 2 for other organisations. Organisations that own, operate or host critical national infrastructure must run their SOC work through a Tier 1 licensed provider.
Q03Are you registered with the NCA?
No. So for work that must go to an NCA-registered or licensed provider, we do not contract directly: we support that provider or your own team, for example with AI red teaming expertise and readiness work. Ask us and we will tell you plainly whether we can take your project.
Q04ECC-2 says cyber roles must be held by Saudis. Can you still help?
Yes. ECC-2 requires your organisation’s own cybersecurity positions to be held by full-time, qualified Saudi professionals. Outside specialists can still provide testing, assessments and advice. We support your Saudi team; we do not replace it.
Q05Will our data leave the Kingdom?
We plan the work so it does not need to: we test your systems where they are, use test accounts where possible, and keep personal data out of our reports. The October 2026 draft PDPL changes would require personal data to be stored in the Kingdom, so we plan for that now.
Q06Which Saudi rules apply to us?
Government bodies and critical infrastructure follow the NCA’s ECC-2:2024. Anyone handling personal data of people in the Kingdom follows the PDPL. Banks and insurers add SAMA’s framework. Our Saudi guide explains each.
Sources

Checked against the official text.

Facts about Saudi rules on this page were checked on 2 November 2026. It is general information, not legal advice.

Next hops

Related pages

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings