Program design
We build a security program that fits your size and your regulator, and that you can afford to keep running.
- Cybersecurity strategy & planning
- Security architecture design
- Compliance audits & advisory
- Data protection & privacy (PDPL)
Riyadh · Est. 2023
Secure the invisible.
Protect the invaluable.
We're a cybersecurity company built by practitioners. We build the software that keeps security programs honest — Regulix, an AI-powered platform for compliance, risk, privacy and security operations, and FlowCraft, which automates everything from SOC playbooks to everyday business workflows.
What we do
Most security programs fail quietly: a policy nobody reads, a risk register last opened before the audit, an alert that sat in a queue all weekend. We fix that with platforms built by security practitioners, starting with Regulix and FlowCraft, that keep your program working every day, not just at audit time.
01 / Platform
Compliance, risk, privacy and security operations on one AI-powered platform.
Regulix replaces the spreadsheet-and-SharePoint routine with a single system of record: frameworks and controls, the risk register, third parties, SOC cases, consent and data subject requests. Map controls once against NCA, SAMA, PDPL and international frameworks, and show an auditor exactly what changed and who changed it.
NCA ECC2:2024
82%7 open findings
SAMA CSFv1.0
76%11 open findings
PDPLSDAIA
64%18 open findings
ISO 270012022
91%3 open findings
| Domain — NCA ECC | Owner | Evidence | Status |
|---|---|---|---|
| Cybersecurity Governance | CISO Office | 24 / 24 | Implemented |
| Cybersecurity Defense | IT Security | 61 / 70 | Partial |
| Cybersecurity Resilience | Infrastructure | 9 / 9 | Implemented |
| Third-Party & Cloud | Procurement | 5 / 11 | Gap |
Likelihood →
2
131
42
5
3
Impact →
- 20Ransomware on core banking estateMitigation 4 of 6 complete · owner: IT Ops
- 16Privileged access not reviewed quarterlyLinked to ECC Defense · due 30 Nov
- 15Personal data held past retention periodLinked to PDPL · DPO review pending
- 9Single cloud region for customer portalAccepted until Q2 2027 · board minute 14
| Vendor | Tier | Data shared | Questionnaire | Score |
|---|---|---|---|---|
| Card processing provider | Critical | Cardholder data | Reviewed | 88 |
| Cloud contact centre | High | Customer PII | Awaiting evidence | 71 |
| Payroll SaaS | High | Employee PII | Reviewed | 83 |
| Facilities management | Low | None | Not required | — |
| Marketing agency | Medium | Contact lists | Overdue 12 days | 54 |
| Case | Severity | Source | SLA | Status |
|---|---|---|---|---|
| SOC-1042 Malicious attachment, finance mailbox | High | FlowCraft | 00:42 left | Contained |
| SOC-1041 Impossible-travel sign-in | Medium | Entra ID | 3:10 left | Investigating |
| SOC-1039 Exposed RDP on staging host | High | Shodan | Met | Closed |
| SOC-1036 Phishing domain registered | Low | urlscan | Met | Closed |
AI agent in Regulix
Meet Rex.
Rex reads your controls, evidence and risk register and does the groundwork, so your team spends its time on decisions instead of spreadsheets.
- Maps controls across NCA, SAMA, PDPL and ISO, so one piece of evidence counts everywhere it applies.
- Reviews evidence and flags what's missing, out of date, or doesn't match the control.
- Scores risk from your assets, open findings and the threat landscape.
- Drafts policies and procedures aligned to the frameworks you're held to.
Which ECC controls would fail if the audit were tomorrow?
Rex
Seven findings are still open. The biggest gap is Third-Party & Cloud: four critical vendors have no current security assessment, and two contracts are missing data-handling clauses.
- Request assessments from 4 vendorsDraft requests
- Add clauses to 2 contractsOpen in Contracts
- Re-test 3 Defense controls with stale evidenceAssign owners
- 3–4 weeks
- from kickoff to go-live, with frameworks pre-loaded.
- 15+ modules
- sharing one data model, so a risk, a control and a vendor point at the same evidence.
- Your choice of hosting
- Cloud SaaS, private cloud, or on-premise. Data can stay in the Kingdom.
Govern
- Compliance management
- Document management
- Contract management
- Audit trail
Assess risk
- Risk register
- Risk assessments
- Mitigation tracking
- Vendor risk management
Respond
- SOC case management
- Threat landscape
- Workflow engine
- Reporting & dashboards
Protect data
- Consent management
- Data subject rights
- Virtual data room
- Asset management
02 / Platform
FlowCraft
Automation that runs at 3 a.m., whether it's a phishing alert or a purchase approval.
FlowCraft is a self-hosted workflow automation platform. Draw a process on a canvas, connect it to the systems you already use, and let it run. For the SOC, that means triaging alerts and containing threats. For the rest of the business, it means routing approvals, onboarding staff and keeping records in sync.
WebhookSIEM alertPOST /hooks/mail-alert
EnrichVirusTotal · AbuseIPDBhash, sender IP, URLs
If / SwitchVerdictscore ≥ 70 → malicious
Microsoft Entra IDRevoke sessionsaffected mailbox owner
HTTP RequestOpen case in Regulixseverity, evidence attached
EmailNotify SOC on-callwith enrichment summary
Execution #4,812
45+ built-in nodes
Threat intel, identity, email, files, HTTP, AI models and general-purpose logic, all on one canvas.
Triggers for any process
Webhooks from your SIEM, forms or business apps, cron schedules for hunts, reports and reminders, or a manual run from the editor.
Built to be audited
Credentials are encrypted at rest. Workflows are versioned with one-click rollback, and every change and run is logged.
Runs on your hardware
FlowCraft is self-hosted, so alerts, records and credentials stay on your network. When a run fails, AI-assisted diagnosis points at the likely cause.
03 / Services
The people behind the platforms do the work too.
Managed services
We work with your team, or act as your security team, for the parts that have to run every week.
- Threat intelligence
- Managed vulnerability management
- Penetration testing
- Source code review
- Risk assessments
Security platforms
We build and support our own software, so improvements come from what we see in client work.
- Regulix: AI-powered compliance, risk, privacy and security operations
- FlowCraft: security and business workflow automation
04 / Why Intangible
Built by people who've sat in the auditor's chair, and the analyst's.
Your regulation, built in
NCA, SAMA and PDPL come pre-loaded alongside ISO 27001 and PCI DSS, and you can add your own framework and map it once. When a framework changes, the platform changes with it.
Built by practitioners
Our team has run security programs in government, banking and industry. We built the tools we wanted to have in those jobs.
Live in weeks
Frameworks come pre-loaded and our engineers handle setup, data import and training, so you're working in the platform within weeks, not quarters.
Your data stays yours
Run Regulix in the cloud, in a private cloud or on your own servers. FlowCraft is self-hosted. Either way, your data stays wherever your regulator requires.
05 / How we work
You'll know whether it works before you commit to it.
- 01
Briefing
A conversation about your regulator, your current tooling and where the pressure is. We don't send a slide deck in place of the conversation.
Week 0 - 02
Live walkthrough
Your frameworks and a sample of your own controls, set up in Regulix or FlowCraft.
Week 1 - 03
Proof of value
Two weeks on a real scope with your team. You keep the output whatever you decide.
Weeks 2–3 - 04
Go-live
Configuration, data import, training and handover, with a named engineer afterwards.
Weeks 4–7
Built for regulated sectors
Government & public sector / Banking & fintech / Insurance / Healthcare / Energy & utilities / Technology / Retail
06 / Contact
Talk to the people who build it.
Tell us what you're working towards, whether that's an upcoming audit, a SOC that's stretched, or a framework you've just been told applies to you. A practitioner will reply within one working day.