Cyber HAYKALAH is a Saudi security operator aligned with the National Cybersecurity Authority's frameworks. We watch, contain and evidence threats for the Kingdom's regulated institutions, and turn national compliance into continuous proof.
Vision 2030 treats cybersecurity as national infrastructure. The NCA, founded in 2017, writes the controls, sets the standards and funds the talent. Demand is mandated, not discretionary, and it survives the budget cycles that end ordinary IT projects.
Detection, data and response stay in the Kingdom. In-Kingdom SOCs and NDMO data residency are the national objective, not a feature.
ECC-2:2024 control 1-2-2 requires qualified, full-time Saudi professionals in every cybersecurity role. Every analyst seat is a national high-skill job.
ECC, OTCC, CCC, NCNICC, the SAMA framework and the PDPL each bind a named population by a named date. Compliance is audited, every year.
CyberIC and the National Cybersecurity Academy localise technology and skills. Operators who make the state's objectives their plan grow with it.
One authority for controls, standards and capability building.
OTCC-1:2022 extends the controls to operational technology and industrial systems.
ECC-2:2024 sets 108 main controls and makes Saudi talent mandatory in every cyber role.
NCNICC-1:2025 brings non-CNI companies under mandatory NCA controls.
The NCA consults on AI cybersecurity guidelines covering generative and agentic AI.
A sovereign, Saudi-staffed cyber sector serving a doubled market.
An operator in Saudi Arabia is governed by a stack, not a single framework. We map every service we sell to the instrument it evidences, so a client buys proof for the assessment that recurs.
Sources: NCA framework texts; SAMA; SDAIA. Status as re-checked October 2026. Every regulatory position is indicative and subject to counsel confirmation.
Six stages, one colour each, run 24/7 from an in-Kingdom operations centre. Select a stage.
Managed detection is the core. Four attached lines open the door to regulated accounts. Choose your sector to see which lines matter most to you.
The buyer purchases evidence for an assessment that recurs, so cancelling does not save money; it creates a finding.
The SOC console every client gets, in the brand's product language: night ground, mono numbers, severity always in words. The data below is simulated.
| Time | ID | Severity | Tactic (MITRE) | Asset | Status | Analyst |
|---|
The brand lattice becomes the client's compliance map: 108 cells for the 108 main controls of ECC-2:2024, each evidenced, in progress or open. The same view extends to SAMA CSF, OTCC, CCC and NCNICC.
SAMA's framework measures cybersecurity maturity on six levels, and Level 3 is the minimum for every regulated institution. Select a level to see what it means and how we help, then try the quick self-check.
The roshan, the lattice window of Jeddah's Al-Balad, let a household watch the street without being watched, let in light and air, and kept out what did not belong. That is the job of a security operations centre. HAYKALAH means structure; we design defence as architecture.
Defence as architecture: layered, documented, repeatable.
24/7, every asset, every log that matters.
Client data stays protected, private and in the Kingdom.
A named analyst, a measured time, an evidence pack.
Operating promises are illustrative and apply once the service is live (brand governance CP-6).
Nothing in the next stage starts until the gate before it is evidenced, and every gate has a stated kill criterion.
Incorporation, commercial registration and named leadership.
In-Kingdom SOC, data platform and a qualified Saudi analyst bench.
In-Kingdom operations live; automation and productivity tested against the board threshold.
Expand service lines and sectors; productivity proven before scale-up capital is released.
A national 24/7 operator serving the Kingdom's regulated institutions across sectors.
people per continuously staffed 24/7 seat. The operating floor sits near 41 people.
beneficiaries targeted by CyberIC Phase 2, launched 21 May 2025.
trainees at the National Cybersecurity Academy in H1 2025 alone.
Saudi nationals in cybersecurity roles, as ECC-2 control 1-2-2 requires.
Sources: NCA; CyberIC; Human Capital Plan V4; Feasibility Study V4. Gates per Business Plan V4. Indicative.
Whether you are a CISO preparing for your next ECC assessment, a partner seeking a Saudi channel, or an investor reviewing the platform, start with a conversation.