Two questions decide your security posture, and they are the same question twice: what can an attacker reach from outside, and what can you evidence to a regulator. SAK Exposure finds what you are exposing; every finding is filed automatically as control evidence in GRCorb; SAK Services fixes what the evidence says is broken. One loop, not three tools.
No agent to install · no access required · 6-page report in 5 business days
That is what turns a scan into compliance: an exposure we find is not just a ticket, it is evidence — mapped to the obligations that actually bind you, in whichever regime you answer to.
Most firms resell someone else's tooling. SAK builds its own — and every offering reads and writes the same asset graph and evidence store, so what one finds, the others act on.
Our product arm builds GRCorb — AI-powered GRC that scopes a framework, generates branded policy packs, quantifies risk with FAIR, collects control evidence automatically and walks an auditor through it. Only GRCorb also shows you how to build each control.
Consultants who work from platform data, not a questionnaire — led by our vCISO engagement, with GRC advisory, testing, cloud and AI security alongside.
Explore SAK ServicesExposure management: continuous external attack surface discovery, threat intelligence, supply-chain risk, brand impersonation and dark-web exposure — six modules on one asset graph.
Explore SAK ExposureA point-in-time audit tells you what was true on one Tuesday in March. This runs every day — and each step hands evidence to the next.
Every internet-facing asset, certificate, subdomain and exposed service — found, not declared.
SAK ExposureExposures scored against live threat intelligence and what's actually being exploited.
SAK ExposureFindings and configuration state collected as control evidence, mapped to obligations.
SAK TechnologiesOwners, due dates and build instructions — how to fix the control, not just that it failed.
SAK TechnologiesControls re-verified continuously. Drift raises an exception the day it happens.
SAK TechnologiesBoard packs and auditor workspaces generated from the same evidence, not rewritten.
SAK TechnologiesA fractional security executive who arrives with the platforms already reporting — so board papers take an hour, not a fortnight. Our most-requested engagement.
From 2 days a month AdvisoryFramework readiness, gap assessment and certification support, run inside GRCorb rather than a spreadsheet.
Delivered in GRCorb ManagedSAK Surface, Brand and Deep run for you as a managed service: continuous discovery, impersonation takedowns and credential-leak alerting, reviewed by a named analyst. Platform-delivered — not a staffed SOC.
Business hours · platform-delivered OffensiveExternal and internal penetration testing, application and infrastructure assessment, and secure code review, scoped from what SAK Surface already found.
Scoped from SAK Surface CloudAWS and Azure posture review, secure landing zones, CSPM tuning and continuous configuration evidence.
Feeds GRCorb monitoring EmergingLLM and agent threat modelling, prompt-injection testing, model supply chain, and an AI governance program that survives audit.
ISO 42001 · NIST AI RMFA named security executive owning your framework readiness, with platform evidence behind every board paper.
Your obligations are mapped natively in GRCorb — NCA ECC, SAMA CSF and PDPL in the Gulf, Essential Eight, the ISM, SOCI and the Privacy Act in Australia, plus ISO 27001, SOC 2 and PCI DSS globally — with the evidence each assessor actually asks for.
| Framework | Who it binds | Obligations mapped | Platform coverage |
|---|---|---|---|
| NCA ECC | All Saudi government entities and critical national infrastructure | ECC-2:2024 · 4 domains · 108 controls | Full |
| SAMA Cyber Security Framework | Banks, insurers and financial institutions regulated by SAMA | 4 domains · maturity levels 0–5 | Full |
| PDPL | Any entity processing personal data of individuals in KSA | Consent · transfer · DPO | Full |
| Aramco CCC (SACS-002) | Third parties connecting to or serving Saudi Aramco | Supplier certification | In build |
| NDMO data standards | Entities handling national data under SDAIA governance | 15 domains | In build |
| ISO/IEC 27001:2022 | Voluntary — commonly contractually required | 93 controls | Full |
| Essential Eight (ML1–ML3) | Federal agencies mandatory; strongly recommended for all | 8 strategies · 3 levels | Full |
| ISM / IRAP | Suppliers handling Australian Government data | 1,100+ controls | Full |
| SOCI Act 2018 | Designated critical infrastructure operators | RMP + reporting | Full |
| Privacy Act 1988 & NDB | Turnover above AU$3m, all health providers | 13 APPs | Full |
| APRA CPS 234 / CPS 230 | Banks, insurers, superannuation funds | Info security + op risk | In build |
| ISO/IEC 27001:2022 | Voluntary — commonly contractually required | 93 controls | Full |
Framework coverage is delivered through SAK Technologies. See what each framework asks for →
We work with accredited specialist firms — ISO certification bodies, offensive security teams and training providers — who deliver alongside our platforms. That is how a product company ships enterprise engagements without pretending to be a body shop, and it means each engagement is staffed by the firm best suited to it, not the only one we have.
ISO 27001, 22301, 9001, 27017/27018, PCI DSS, SOC 1/2/3 and SAMA CSF certification and audit practice.
Feeds GRCorb audit workspaceBlack, white and grey box penetration testing, malware analysis, compromise assessment, secure code review.
Feeds SAK SurfaceInternationally accredited IT security training and certification courses for client teams, run by partner training faculties.
Records filed as evidenceGive us a domain. SAK Surface maps every internet-facing asset, expiring certificate, exposed service and lookalike domain we can see from the outside. You get a six-page report in five business days. No agent, no access, no obligation.
Request the reportEnglish & Arabic reporting · partner-delivered execution