EhsanLab is a team of QA engineers and offensive security specialists in Riyadh. We test your releases, attack your systems the way real adversaries would, and map every fix to the NCA and SAMA controls you answer to.
TEAMS ACROSS THE GCC TRUST US WITH THEIR CRITICAL SYSTEMS
A passed audit proves that controls exist on paper. It doesn't tell you whether checkout holds on salary day, or whether an attacker can get around your MFA.
We test for what actually happens, then map every finding back to the NCA, SAMA and ISO controls you report on. You get the certificate, and the confidence that is supposed to come with it.
Two different questions
Are the required controls in place and documented?
Do those controls hold when someone pushes on them?
Evidence for the auditor, and fixes for the engineers.
Most companies hire one firm to test and another to attack. We do both, so a defect found in QA and a vulnerability found in a pentest land in the same backlog, ranked by the same measure of risk.
QA TESTING
Our engineers work inside your sprints, not at the end of them. We automate the regression your team is tired of running by hand, load-test the journeys your customers actually take, and keep a person on exploratory testing where scripts miss things.
CYBERSECURITY
Certified testers take on the role of the people who actually target organizations in the region, from opportunistic scanners to patient, targeted intruders. You get a clear record of what we reached, how we got there, and what it takes to close the gap.
We know what NCA, SAMA, CITC, NDMO and SDAIA auditors ask for, and we write our evidence the way they expect to read it. We work like part of your team, on your hours, and we speak your language.
Our AI-assisted tooling writes edge cases and repairs brittle scripts, which cuts test cycles by up to 60% without losing coverage. Engineers still decide what gets tested and sign off every finding.
A PDF of findings doesn't fix anything. We work with your engineers through remediation, retest every fix, and treat your outcomes as our own, release after release.
Four stages, run the same way every time, so you always know where things stand and what comes next.
Architecture walkthroughs, a look at your pipeline, and time with the people who own the risk. Nothing gets tested until we know what matters most to the business.
Every exposed asset, integration and user role is listed and ranked. You approve the scope before any testing starts.
Automation for breadth, manual testing for depth. Critical issues are raised as soon as they are confirmed, not saved for the final report.
Each issue comes with its severity, the proof, and a fix your developers can apply. Once it is patched, we retest and close it.
SAMA-regulated banks and lenders
Agencies running critical services
Patient data and clinical systems
Core networks and customer platforms
Checkout, payments and PCI DSS
OT and ICS environments
Open banking and digital wallets
Cloud-native products at scale
Six practice areas, each run by specialists, all reporting to one engagement lead who knows your systems.
QUALITY ENGINEERING
Quality is built in across the delivery cycle: a test strategy at planning, automation while you build, and performance checks before anything ships.
CYBERSECURITY
We go after your network, applications, APIs and cloud configuration the way a motivated intruder would, then help you close every gap we open.
AUTOMATION & AI
Selenium, Playwright and Cypress suites built to last, with AI-generated edge cases and visual checks that catch the layout breaks people miss.
PERFORMANCE ENGINEERING
We load-test the journeys that matter on your busiest days (salary day, sale season, Ramadan evenings) and tune the API and database layers until they hold.
TECHNOLOGY ADVISORY
QA maturity assessments, DevSecOps roadmaps, architecture reviews and certification support, written as plans with owners and dates rather than slide decks.
EXPERT & MANAGED TEAMS
Certified QA engineers, security analysts and test leads who join your squads, follow your rituals, and work to an agreed SLA.
“EhsanLab discovered 14 critical vulnerabilities in our payment infrastructure that our internal team had missed for 18 months. Their penetration testing team operates with military precision.”
“We engaged EhsanLab for our Vision 2030 digital transformation. Their AI-augmented framework reduced our release cycle from 6 weeks to 4 days. Genuinely transformational.”
“Their ISO 27001 compliance audit was the most thorough we have experienced. EhsanLab does not just check boxes, they truly understand security. We have been clients for 4 consecutive years.”
How we work and the standard we leave behind.
FIVE PILLARS. ONE STANDARD. LASTING IMPACT.
Compliance
Saudi controllers have 72 hours to notify SDAIA after becoming aware of a personal data breach. The hour-by-hour decisions you make, and the work you did before, decide whether you can.
ReadCybersecurity
A chatbot or RAG copilot inside a banking app is a new attack surface running on old failure modes. The OWASP LLM Top 10 names them; here is how we design and test around the ones with no clean fix.
ReadCybersecurity
Broken object level authorization is the finding we raise most often on API engagements, and one of the few you can design out for good rather than patch endpoint by endpoint.
ReadOver 200 organizations across Saudi Arabia and the GCC already trust EhsanLab with their most critical security and quality work. Book a free consultation and we'll tell you honestly where we would start.