One platform to find exposure, test defences and prove compliance.
See what an attacker can reach, test whether your defences would stop them, and prove it to your regulator — on one platform we build ourselves. Native to NCA ECC, SAMA CSF, PDPL, Essential Eight and ISO 27001, in Arabic and English.
No agent to install · no access required · 6-page report in 5 business days
Three products. One asset graph.
We build our own software — not resold, not white-labelled. One tells you what an attacker can reach, one proves whether they could get in, and one proves what you control. They share a single picture of your organisation.
GRCorb
AI-powered GRC: scope a framework, generate branded policy packs, quantify risk with FAIR and collect control evidence automatically — with build instructions for every failing control.
- 52 frameworks, 3,885 obligations
- Policy, risk, evidence & audit in one place
- Live at grcorb.com
Attack surface monitoring
Continuous external discovery, threat intelligence, supply-chain risk, brand impersonation and dark-web exposure — six modules that share one asset graph, with nothing to install.
- Six modules, one asset graph
- Scored against live threat intelligence
- No agents, no access required
SAK Red Teaming New
An agentic attack-simulation and penetration-testing platform — 35 specialist agents and a 326-tool arsenal that confirm which weaknesses are genuinely exploitable and map the paths that reach your crown jewels. Safe by default, authorized in writing, MITRE ATT&CK-mapped.
- 35 agents · 326 vetted tools
- Four authorized levels, safe by default
- License it, or have us run it
Six ways we deliver — from platform data, not a questionnaire
Every engagement is led from the same asset graph and evidence store the products fill, so nothing is discovered twice and board papers take an hour, not a fortnight.
vCISO Flagship
A fractional security executive who arrives with the platforms already reporting — board papers in an hour, not a fortnight. Our most-requested engagement.
From 2 days a month →Red teaming & VAPT
External and internal penetration testing, run for you on SAK Red Teaming — 35 specialist agents, MITRE ATT&CK-mapped findings, safe by default.
Runs on SAK Red Teaming →GRC advisory
Framework readiness, gap assessment and certification support, run inside GRCorb rather than a spreadsheet.
Delivered in GRCorb →Managed attack surface
SAK Surface, Brand and Deep run for you: continuous discovery, impersonation takedowns and credential-leak alerting, analyst-reviewed in business hours.
Platform-delivered →AI security & governance
LLM and agent threat modelling, prompt-injection testing, model supply chain, and an AI governance program that survives audit.
ISO 42001 · NIST AI RMF →Awareness & training
Phishing simulation and role-based training, with completion records filed straight into the evidence store.
Evidence auto-filed →From static compliance to continuous assurance
A point-in-time audit tells you what was true on one Tuesday in March. SAK runs every day — each step hands evidence to the next.
- 01
Discover
Every internet-facing asset, certificate, subdomain and exposed service — found, not declared.
Attack surface monitoring - 02
Test
SAK Red Teaming confirms which exposures are genuinely exploitable and maps the paths that reach your crown jewels.
SAK Red Teaming - 03
Evidence
Findings and configuration state collected as control evidence, mapped to obligations.
GRCorb - 04
Remediate
Owners, due dates and build instructions — how to fix the control, not just that it failed.
GRCorb - 05
Assure
Controls re-verified continuously. Drift raises an exception the day it happens.
GRCorb - 06
Report
Board packs and auditor workspaces generated from the same evidence, not rewritten.
SAK Technologies
Built for your regulator, not translated for it
Your obligations are mapped natively in GRCorb — NCA ECC, SAMA CSF and PDPL in the Gulf, Essential Eight, the ISM, SOCI and the Privacy Act in Australia, plus ISO 27001, SOC 2 and PCI DSS globally — with the evidence each assessor actually asks for.
Gulf
- NCA ECC-2:2024All 200 controls & sub-controls
- SAMA Cyber Security FrameworkAll 247 controls
- PDPL16 controller obligations
- Aramco CCC (SACS-002)Via services
- NDMO data standardsVia services
Australia
- Essential Eight (ML1–ML3)All 126 controls
- ISM / IRAPAll 1,150 controls
- SOCI Act 201814 obligations
- Privacy Act 1988 & NDBAll 13 APPs + NDB
- SMB1001:2026All 39 controls
- APRA CPS 234 / CPS 23024 + 22 requirements
Global
- ISO/IEC 27001:2022All 93 controls + clauses 4–10
- SOC 2All 61 criteria
- PCI DSS v4.0.1All 249 requirements
- GDPR27 obligations
Every figure is counted from GRCorb's own catalogue. “All” means every item of the published framework is in GRCorb. A plain number is the set of obligations organisations are assessed against, not every clause. Via services — delivered by SAK Services consultants; not yet a GRCorb framework.
Start with your free external exposure report
Give us a domain. SAK Surface maps every internet-facing asset, expiring certificate, exposed service and lookalike domain we can see from the outside. You get a six-page report in five business days. No agent, no access, no obligation.
English & Arabic reporting · partner-delivered execution