FalehSec is a Riyadh-based cybersecurity company with a verified track record of discovering critical vulnerabilities in production systems at global companies. Available for web application, network, API, and cloud security engagements.
FalehSec began in enterprise IT support — fixing systems and wondering how they'd actually been broken. That curiosity became a full-time offensive security company serving clients in Riyadh and globally.
Our specialists hold five professional certifications — including CPTS and eWPTXv2 — and stay active in bug bounty programs. Together we've found critical, real-world vulnerabilities in production systems at global companies and have been trusted by enterprise clients in Riyadh.
This is a full-time commitment, not a side project. We write reports for humans, not just developers: every finding includes business impact, reproduction steps, and fixes your team can actually apply. Delivery is in Arabic and English, under NDA, on a fixed quote and timeline.
Structured security assessments delivered with clear, actionable reports. Every engagement includes a retest to confirm your fixes are effective.
Fixed quote and timeline confirmed before any work begins.
Testing aligned with OWASP Top 10:2025, NIST SP 800-115, and mapped to the SAMA Cyber Security Framework and NCA Essential Cybersecurity Controls (ECC) compliance expectations — ideal for regulated Saudi enterprises.
Manual testing of your web applications for OWASP Top 10 vulnerabilities — IDOR, XSS, authentication bypass, business logic flaws, and more. Includes full PoC documentation.
Internal and external network assessments targeting misconfigurations, weak credentials, lateral movement paths, and privilege escalation opportunities across your infrastructure.
Manual review of cloud environments (AWS, Azure) for misconfigurations — exposed S3 buckets, overpermissioned roles, insecure storage, and weak access controls before attackers find them first.
Systematic scanning and manual review of your environment to identify, classify, and prioritize security weaknesses — ideal as a first step before a full pentest engagement.
Deep testing of REST and GraphQL APIs for BOLA/IDOR, broken authentication, excessive data exposure, and mass assignment — including business logic abuse specific to your API design.
After your team addresses findings from a pentest, we retest every vulnerability to confirm the fix is effective and no new issues were introduced in the process.
Every engagement follows a recognised methodology, and findings are mapped to the framework that applies to your organisation — so your audit or inspection has evidence it accepts, first time.
The baseline control set mandated for government entities and regulated sectors across the Kingdom.
Enhanced controls for operators of critical national infrastructure and high-impact systems.
Controls for cloud environments and services operating inside the Kingdom.
The NCA controls for operational technology and industrial control systems.
Testing aligned to the Saudi Central Bank framework, including the annual penetration testing requirement.
Testing that exposes risks to the personal data your systems process, and evidence for the technical safeguards PDPL expects.
Penetration testing and evidence for card-handling environments.
Testing and reporting that feed your ISMS, risk treatment, and certification evidence.
Penetration testing for the organisations regulators scrutinise most — delivered with evidence your auditor can use.
Entities subject to NCA controls and national cyber requirements.
Banks, insurers and fintech operating under SAMA's cybersecurity framework.
Industrial and OT environments where availability is mission-critical.
Patient data and clinical systems protected by PDPL and sector rules.
Customer-facing platforms, APIs and cloud infrastructure.
Organisations handling client and personal data at scale.
A clear, low-friction process from the first conversation to a confirmed fix. You always know what happens next — and what it costs.
A 30-minute call to understand your environment, goals, and anything off-limits. You get a fixed quote and timeline before any work begins.
Targeted manual and structured testing against the agreed scope, with progress updates along the way — never a silent black box.
A clear report ranked by business risk, with reproduction steps, proof-of-concept evidence, and practical fix guidance your team can act on.
After your team applies fixes, we retest every finding to confirm it is resolved — and confirm no regressions were introduced.
Every engagement starts with a free, no-obligation scoping call.
Book Your Free Scoping CallReal vulnerabilities discovered and responsibly disclosed in production systems at global companies through bug bounty programs.
Third-party-owned apex bucket served via CloudFront on an HSTS domain, allowing full control over served assets. Followed by a world-writable S3 origin leading to stored XSS via JavaScript chunk injection.
Missing ownership checks on P2P offer endpoint exposed bank and payment details of 81 distinct users across 118 offers. No authentication bypass required — a structural authorization failure.
JWT-embedded country code claim not re-validated per request, allowing financial withdrawal API to be reached from any egress IP, bypassing country-level financial controls entirely.
Missing re-authentication on email, password, and 2FA change endpoints enabled complete account takeover from a single valid session. Step-up controls existed on other endpoints, confirming deliberate misapplication.
Non-merchant users at LEVEL_0 could mint valid merchant API keys accepted by production merchant endpoints, effectively granting unauthorized merchant-tier access.
Three critical vulnerabilities identified including OTP hijacking, JSON manipulation exploit, and email flooding attack vector. Recognized for responsible disclosure by flynas security team.
Hands-on, practical certifications from recognized offensive security bodies — not just theoretical knowledge.
Four quick choices and we'll draft an engagement brief you can send us. A fixed quote follows a short scoping call — scope drives cost, so we don't price blind.
Estimated timeline: 4–7 days
Final quote depends on scope, access requirements, and testing complexity.
Straight answers to the questions clients ask most before starting an engagement.
Tell us about your environment and what you need tested. We'll respond within 24 hours with a clear scope, timeline, and pricing.
Download: “What to prepare” for the scoping call
We publish real security research. And we hire beyond pentesting — if you want to do work that holds up in public, whatever the role, reach out.
See careers →Want us to recommend the right assessment for your stack? 30s.
👋 I'm the FalehSec assistant — ask me anything about pentest.