Compliance

For years, if you ran a private company in Saudi Arabia, the National Cybersecurity Authority’s (NCA) controls were something you admired from a distance. They applied to government entities and critical national infrastructure operators. If you weren’t in those categories, you could read the frameworks, nod along, and carry on. That era just ended. In December 2025, the NCA published NCNICC-1:2025, the Non-Critical National Information Infrastructure Cybersecurity Controls. It took effect in January 2026. And for the first time, a binding NCA framework now applies directly to the general private sector. If you run a private company in the Kingdom, this is now your problem to solve, not someone else’s. ...

I’ve lost count of how many times I’ve heard someone say “our cloud is secure” right before finding a bucket wide open to the internet. Here’s the thing - most people aren’t lying when they say that. They genuinely believe their environment is locked down. And then you run a quick scan and find 50 misconfigurations you never knew existed. That’s the cloud security problem in a nutshell. You don’t know what you don’t know. ...