Cybersecurity
Phishing Simulation in Saudi Arabia: Email, SMS, Voice and QR Tests
Waves runs phishing simulation in Saudi Arabia that goes beyond email: fake SMS, voice calls, QR codes and MFA approval tests, in Arabic and English. Staff who click get instant micro-training, and management gets clear risk reports by department.
- Email, SMS, voice and QR tests
- Campaigns in Arabic and English
- Reports for management and auditors
10 yearsin cybersecurity
150+companies passed Aramco CCC
Gold PartnerSophos & Fortinet
Phishing simulation in Saudi Arabia that matches real attacks
Most successful attacks still start with a person: someone clicks a link, scans a code, reads out a one-time password or approves a sign-in they did not start. Filters and firewalls catch a lot, but not everything. The last line of defence is your staff.
Phishing simulation in Saudi Arabia shows you how your people react before a real attacker finds out. We send safe, realistic fake attacks to your own users, record what they do, and turn every mistake into a short lesson. Over time you see clicks fall and reports rise.
Real attackers do not only use email, so neither do we. Each campaign can combine several channels, based on what your teams actually receive.
- Email phishing with links, attachments and fake login pages
- SMS phishing (smishing) from fake couriers, banks or services
- Voice phishing (vishing) calls pretending to be IT or a manager
- QR-code phishing on posters, invoices and emails
- MFA fatigue and fake approval-request tests
Vishing, smishing and MFA approval tests for Saudi teams
Vishing and smishing simulation in Saudi Arabia covers the attacks that email filters never see. A fake SMS about a held parcel, a call from "the help desk" asking for a code, or a flood of sign-in approval prompts at night can all lead to a stolen account.
We agree every scenario with you first, including who is in scope, which numbers are used and what the caller may ask. Finance, HR, IT support and executive assistants are often targeted, so we can focus tests on them.
MFA fatigue tests check whether staff approve a sign-in request they did not start. This is important because multi-factor authentication is required on remote access, cloud, email and privileged accounts under Aramco SACS-210 (TPC1.12). Strong MFA only works if people refuse requests they do not expect.
Every test is safe: no real passwords are stored, no malware is used, and calls follow a script you approve.
How Waves runs your phishing simulation programme
Kick-off and scope
We agree goals, departments, channels, languages and rules of engagement with your management and IT team.
Baseline test
A first campaign measures how many people click, scan, call back or approve today, so progress can be tracked.
Monthly campaigns
Each month brings new scenarios in Arabic and English, varied by channel and difficulty and timed around real events.
Instant micro-training
Anyone who falls for a test sees a short lesson straight away, explaining the warning signs they missed.
Risk scores and reports
You get a monthly report with risk scores by department, trends over time and the staff who report phishing correctly.
Review and improve
We meet with you each quarter to review results, adjust targeting and plan extra support for high-risk groups.
What is included
Multi-channel tests
Email, SMS, voice, QR-code and MFA approval simulations, run alone or combined in one campaign.
Arabic and English campaigns
Scenarios written for Saudi workplaces, in the language each team actually reads and speaks.
Instant micro-training
Short lessons shown at the moment of the mistake, when people are most ready to learn.
Department risk scores
See which departments, sites or roles are most at risk and how this changes month to month.
Reports for auditors
Clear records of campaigns, results and training completed, ready for management and audit reviews.
Managed or in-house
We run the programme for you as a managed service, or license it to your IT team and train them to run it.
Awareness evidence for SACS-210 and NCA ECC
Aramco's SACS-210 Third Party Cybersecurity Standard (February 2026) requires yearly mandatory awareness training for all users (TPC-2.26). Auditors want to see that awareness is delivered, completed and checked, not only that a policy exists.
The NCA Essential Cybersecurity Controls (ECC), which apply to government bodies, critical sectors and their suppliers, also include cybersecurity awareness. Regular simulations, with training for people who click and reports for management, give you practical evidence for both.
Because we have helped more than 150 companies pass Aramco CCC, we know what evidence reviewers usually ask for and how to present it clearly.
SACS-210 TPC-2.26: yearly mandatory cybersecurity awareness training for all users.
Frequently asked questions
What is a phishing simulation?
It is a safe, planned fake attack sent to your own staff. Messages look like real phishing, but nothing harmful happens when someone clicks. We record who opened, clicked, scanned or entered details, then use the results to train people and measure progress.
How is this different from security awareness training?
Training teaches people what to look for. Simulation tests whether they actually spot it in their normal working day. Most companies need both: training builds knowledge, and regular simulations show where that knowledge is still weak.
Do you test SMS and phone calls, not only email?
Yes. Attackers in Saudi Arabia often use fake SMS from couriers, banks or government services, and phone calls pretending to be IT support or a manager. We run smishing and vishing tests alongside email, QR-code and MFA approval tests, agreed with you in advance.
Can the campaigns be in Arabic?
Yes. We prepare campaigns in Arabic and English, so staff see the same kind of messages they receive in real life. We can mix both languages in one campaign or target each department in the language it uses most.
Will staff be punished if they click?
That is your decision, but we recommend against it. People who click see a short training page straight away, and repeat clickers get extra support. The aim is fewer clicks and more reports, not blame. Management reports can show departments rather than names if you prefer.
Does this help with Aramco CCC and SACS-210?
SACS-210 includes yearly mandatory awareness training for all users (TPC-2.26). Regular simulations with training for people who click, plus clear reports, give you evidence that awareness is being delivered and measured. It also supports the awareness requirements in the NCA Essential Cybersecurity Controls.
Can our own IT team run the simulations?
Yes. We can run everything for you as a managed service, or license the platform to your in-house team and train them to build and schedule campaigns. Many companies start managed and take over later.
See how your staff would react to a real attack
Book a free demo and we will show you sample campaigns in Arabic and English, the micro-training and the management reports.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
