Thagharat is a penetration testing practice built on manual, evidence-driven work. We attack your systems the way a real adversary would — then hand you a report your engineers can act on and your auditors will accept.
Certified by eLearnSecurity · INE · OCEG
Automated tools find the obvious. We are hired for everything underneath it — business logic, chained exploits, and the misconfigurations no signature catches.
Full-depth assessment of authentication, session handling, access control, injection surfaces and business logic. We chain low-severity issues into the high-impact paths a scanner will never report.
External perimeter and internal network assessments, Active Directory attack paths, lateral movement, and privilege escalation to domain compromise — executed safely, under agreed rules of engagement.
iOS and Android testing across the full stack: local storage, certificate pinning, IPC, reverse engineering resistance and the backend APIs the app depends on.
REST and GraphQL testing for broken object-level authorization, mass assignment and rate-limit failures — alongside cloud configuration review across identity, storage and network boundaries.
Objective-based adversary simulation that tests detection and response, not just vulnerabilities. Phishing campaigns, pretexting and physical access scenarios, scoped to what you actually want measured.
Gap assessments and readiness work mapped to the frameworks your regulator audits against. We translate technical findings into control-level evidence your compliance team can file.
Every engagement runs the same disciplined path. You always know what stage we are at, what we have found, and what happens next.
We agree targets, testing windows, escalation contacts and hard boundaries in writing before a single packet is sent. NDA signed up front.
Attack surface mapping and threat modelling against your actual business risk — so effort goes where a real attacker would concentrate it.
Findings are proven, not guessed. Each one is manually exploited and captured with a reproducible proof of concept. No unverified scanner noise reaches your report.
An executive summary your board can read, and a technical section your engineers can act on. CVSS-scored, mapped to remediation steps and framework controls.
After you fix, we verify. A retest of all confirmed findings is included, with a clean closure letter you can hand to auditors or clients.
Tooling accelerates discovery; it never replaces judgement. The findings that matter come from a human reading your application logic.
If we report it, we exploited it. Every finding ships with reproduction steps and evidence, so your team never wastes a sprint chasing a phantom.
Full deliverables in Arabic and English. The same report satisfies a local regulator and an international parent company.
Remediation verification is part of the engagement, not a change order. You get a closure letter when the findings are confirmed fixed.
Anything critical is escalated the moment it is confirmed. You do not wait for the final report to learn your perimeter is open.
Destructive techniques stay out of scope unless you explicitly authorise them. Production testing follows agreed windows and abort conditions.
Nine years of hands-on offensive security, backed by certifications on both sides of the table — the people who break systems, and the people who audit them.
A penetration test is only half the deliverable. We map every finding to the control it breaks, so the report doubles as compliance evidence.
Technical testing aligned to NCA ECC control domains, with findings mapped to the specific controls they affect.
Assessment support for financial institutions operating under the SAMA framework and its maturity expectations.
Review of how personal data is stored, transmitted and exposed across your applications and interfaces.
Annex A control testing and evidence packages that fit directly into your ISMS documentation and audit cycle.
Segmentation testing and application assessments meeting Requirement 11 penetration testing obligations.
Engagements follow OWASP WSTG and MASVS, with reporting structured around the NIST SP 800-115 methodology.
Send a short description of your environment and we will come back with a scope, timeline and fixed price. No sales calls, no obligation, and an NDA before any technical detail is shared.
Fastest route — usually answered same day