SAK T.E.CTechnology · Evaluation · Compliance Book a demoDemo
Autonomous exposure management · for regulated enterprise

Attack-ready. Audit-ready. One platform.

See which threats attackers are exploiting right now, find where you are exposed to them, and turn every fix into evidence your regulator accepts.

Free · no agent to install · no access needed · 6-page report in 5 business days · or book a live demo

How it works

One exposure, followed from the headline to the audit file

Three tools you can buy separately, sharing one asset graph. Here is the same finding moving through all three.

01 · Know it

Threat Landscape Monitoring

Which of the 1,773 exploited vulnerabilities matter to us?

T.L.M watches CISA’s exploited list and FIRST’s exploitation-probability scores, filters them to your technology and sector, and ranks what to fix first. Advisories arrive because they affect you, not because they were published.

Explore Threat Landscape Monitoring →
Threat Landscape Monitoring · example-bank.comSample data

Fix first · ranked by what attackers are exploiting

1Source-code server under active attackgit.example-bank.com · internet-facingExploited65%Fix today
2VPN login can be bypassedvpn.example-bank.com · internet-facingExploited41%This week
3Website CMS can be taken overwww.example-bank.com · internet-facingExploited28%This week
4Database driver rated “critical”internal only · no exploitation seenNot exploited2%Schedule
312open findings across the estate
3need action this week
309can wait, with the reason recorded
02 · Find it

Threat Exposure Center

What can an attacker actually reach?

Specialist agents discover what you expose and compute the real attack paths across Active Directory, cloud and Kubernetes. Each finding carries the fix that breaks it and the detection that catches it, under a signed scope, an audit trail and a kill switch.

Explore Threat Exposure Center →
Threat Exposure Center · example-bank.comSample data

Attack path · from the internet to your crown jewels

InternetExposed web serverService accountDomain Admins
Web server can be taken over from the internetweb01.example-bank.com · proven with captured evidenceValidated
The fix that breaks it: patch the web serverOne change cuts 11 of the 14 routes to Domain AdminsChoke point
The detection that catches it: rule ready for your SIEMSigma · Splunk · Sentinel · with the log source it needsDetection
14attack paths reach critical systems
1fix breaks 11 of them
Signed scopeKill switchAudit trail
03 · Prove it

GRCorb

Can we prove we comply, today?

The fix becomes an owned, dated task. Evidence collects itself through 30 connectors, timestamped and hash-sealed, and maps to the obligations of 52 frameworks. The board gets a PDF from live evidence, in English or Arabic, and your assessor works inside the platform.

Explore GRCorb →
GRCorb · example-bank.comSample data

Compliance posture · live, by framework

NCA ECC86%
SAMA CSF79%
Essential Eight83%
PCI DSS86%

Fixes in progress · owned and dated

Patch the web serverInfrastructure team · due in 2 days · evidences ECC 2-10From T.L.M
Renew the payments certificatePlatform team · due in 5 daysFrom Exposure Center
74%of evidence collected automatically
52frameworks ready to scope
Board PDFAuditor workspaceالعربية
Built in-houseOur own software. Not resold, not white-labelled.
AI off by defaultYou switch it on. It advises, your people approve.
Your data, your regionSaaS, dedicated tenant or fully air-gapped.
Arabic and EnglishFull right-to-left. Board packs in either.
52 frameworks3,895 obligations from the regulators’ own catalogues.
Built for your regulator

Which rulebook are you held to?

Pick one. See exactly what is covered before you speak to anyone.

NCA ECC200controls and sub-controls, all mappedECC-2:2024 · 4 domains · 28 subdomains

Everything NCA ECC asks for, in one place

Who it binds: All Saudi government entities and critical national infrastructure.

  • Every obligation assigned to an owner, with a due date
  • Evidence collected through connectors, timestamped and hash-sealed
  • Build instructions for each failing control, not just a red score
  • Your assessor works inside the platform
See it on NCA ECC Full coverage table ↗
SAMA CSF251controls, all mapped4 domains · maturity levels 0 to 5

Everything SAMA CSF asks for, in one place

Who it binds: Banks, insurers and financial institutions regulated by SAMA.

  • Every obligation assigned to an owner, with a due date
  • Evidence collected through connectors, timestamped and hash-sealed
  • Build instructions for each failing control, not just a red score
  • Your assessor works inside the platform
See it on SAMA CSF Full coverage table ↗
PDPL16controller obligationsLawful basis, cross-border transfer, breach notification and DPO duties

Everything PDPL asks for, in one place

Who it binds: Any entity processing personal data of individuals in KSA.

  • Every obligation assigned to an owner, with a due date
  • Evidence collected through connectors, timestamped and hash-sealed
  • Build instructions for each failing control, not just a red score
  • Your assessor works inside the platform
See it on PDPL Full coverage table ↗
Essential Eight126controls, all mapped8 strategies · maturity levels ML1 to ML3

Everything Essential Eight asks for, in one place

Who it binds: Australian federal agencies (mandatory), and strongly recommended for all.

  • Every obligation assigned to an owner, with a due date
  • Evidence collected through connectors, timestamped and hash-sealed
  • Build instructions for each failing control, not just a red score
  • Your assessor works inside the platform
See it on Essential Eight Full coverage table ↗
APRA CPS 234 / 23046requirements (24 + 22)Information security and operational risk

Everything APRA CPS 234 / 230 asks for, in one place

Who it binds: Australian banks, insurers and superannuation funds.

  • Every obligation assigned to an owner, with a due date
  • Evidence collected through connectors, timestamped and hash-sealed
  • Build instructions for each failing control, not just a red score
  • Your assessor works inside the platform
See it on APRA CPS 234 / 230 Full coverage table ↗
ISO 2700193Annex A controls, plus clauses 4 to 10ISO/IEC 27001:2022 · four themes

Everything ISO 27001 asks for, in one place

Who it binds: Voluntary, and commonly required by contract.

  • Every obligation assigned to an owner, with a due date
  • Evidence collected through connectors, timestamped and hash-sealed
  • Build instructions for each failing control, not just a red score
  • Your assessor works inside the platform
See it on ISO 27001 Full coverage table ↗
PCI DSS249requirements, all mappedPCI DSS v4.0.1

Everything PCI DSS asks for, in one place

Who it binds: Any organisation storing, processing or transmitting card data.

  • Every obligation assigned to an owner, with a due date
  • Evidence collected through connectors, timestamped and hash-sealed
  • Build instructions for each failing control, not just a red score
  • Your assessor works inside the platform
See it on PCI DSS Full coverage table ↗
SOC 261criteria, all mappedTrust services criteria

Everything SOC 2 asks for, in one place

Who it binds: Service providers asked for assurance by their customers.

  • Every obligation assigned to an owner, with a due date
  • Evidence collected through connectors, timestamped and hash-sealed
  • Build instructions for each failing control, not just a red score
  • Your assessor works inside the platform
See it on SOC 2 Full coverage table ↗
What changes

The week before the audit, with and without SAK

TodayWith SAK T.E.C

A 40-page scanner report, sorted by severity score

A short list, ranked by what attackers are exploiting this week

An asset register nobody fully trusts

Every internet-facing asset found from the outside, including the forgotten ones

Evidence gathered in a panic, by screenshot and email

Evidence collected every day through 30 connectors, sealed and mapped to each control

A penetration test once a year

Attack paths validated continuously, each with its fix and its detection

Three vendors and three versions of the truth

One asset graph. Nothing is discovered, ranked or evidenced twice

A board pack built by hand each quarter

A board PDF from live evidence, in Arabic or English, whenever it is asked for

The platform

Three tools. One loop. Buy one or all three.

1 · Know it

Which threats actually matter to us?

Threat Landscape Monitoring

  • Every vulnerability attackers are exploiting now
  • Each one ranked by its probability of exploitation
  • Advisories that reach you because they affect you
See Threat Landscape Monitoring → 2 · Find it

What can an attacker actually reach?

Threat Exposure Center

  • Real attack paths across Active Directory, cloud and Kubernetes
  • Every finding carries its fix and the detection that catches it
  • Governed: signed scope, audit trail and a kill switch
See Threat Exposure Center → 3 · Prove it

Can we prove we comply, today?

GRCorb

  • 52 frameworks, assigned, tracked and evidenced
  • AI drafts your policy pack in minutes
  • Build instructions for every failing control
See GRCorb →
Get started

Three ways to start. One is free.

Start here

Free

Your external exposure report

Give us a domain. Get a six-page report in five business days showing what an attacker can already see. No agent, no access, no obligation.

Get my free report
See it live

Demo

All three tools, on your frameworks

A walkthrough on the regulators that bind you, in your working hours, in Arabic or English.

Book a demo
Ready to buy

Quote

An edition tailored to your scope

SaaS, a dedicated tenant in your region, or self-hosted and air-gapped. Priced to your frameworks and size.

Request a quote
30 connectors

Connects to the stack you already run

Each connector uses its own read-only key. Jira and ServiceNow also work both ways, so a finding raised as a ticket closes back when the work is done.

Microsoft 365 / Entra IDGoogle WorkspaceActive Directory / LDAPOktaPingOneJumpCloudAmazon Web ServicesMicrosoft AzureGoogle CloudKubernetesMicrosoft IntuneJamfCrowdStrike FalconSentinelOneGitHubGitLabBitbucketSIEM (Splunk / Sentinel / Elastic)Tenable / NessusTitania NipperQualysSecurityScorecard / BitSightJiraServiceNowDropboxBoxWorkdayBambooHRVeeam Backup & ReplicationKnowBe4
SAK Services

Prefer it run for you?

Our consultants work from the same platform data, so they start from what it already found, not from a questionnaire.

Leadership

vCISO

A fractional security executive who arrives with the platforms already reporting.

From 2 days a month → Offensive

Red teaming & VAPT

Consultant-led testing run on Threat Exposure Center, proving which weaknesses are real.

See services → Advisory

GRC advisory

Gap assessment and certification readiness, run inside GRCorb instead of a spreadsheet.

See services → Emerging

AI security & governance

LLM and agent threat modelling, prompt-injection testing and an AI governance programme that survives audit.

See services →
Before you ask

What security and procurement want to know

Do we need to install anything?

Not to start. Threat Exposure Center begins with external discovery from a domain name, with no agent and no access. Deeper internal testing runs only on a scope you sign, through connectors you authorise. GRCorb collects evidence through connectors, each with its own read-only key.

Where does our data live?

You choose: SaaS hosted and managed for you, a dedicated single-tenant instance in your chosen region, or self-hosted and air-gapped inside your own network.

Where does AI come in, and can we keep it off?

AI drafts policies, screens evidence and suggests risks. It is off until you switch it on, it advises and your people approve, and the self-hosted edition can use a local AI model so data never leaves your network.

How is it priced?

Pricing is tailored to your scope, edition and deployment. Tell us your frameworks and size and we put a quote together. The free exposure report is a no-obligation way to start.

Can you run it for us?

Yes. SAK Services (vCISO, GRC advisory, red teaming and managed exposure) works from the same platform data, so engagements start from what the platform already found.

Start with your exposure, not a sales call

Give us a domain. Threat Exposure Center maps every internet-facing asset, expiring certificate and exposed service we can see from the outside, and T.L.M ranks what matters. You get a six-page report in five business days. No agent, no access, no obligation.

Request the report Chat on WhatsApp

English & Arabic reporting · partner-delivered execution

Chat with us