Cybersecurity
Cyber Incident Response in Saudi Arabia
When ransomware hits, an account is taken over or a fake invoice gets paid, the first hours decide how much you lose. Waves Telecom helps Saudi companies contain the attack, find out what happened, recover safely and meet their reporting duties, then close the gaps so it does not happen again.
- Containment and recovery
- Investigation and reporting
- IR plans and tabletop exercises
Under attack now? Call or WhatsApp +966 58 236 5619 and tell us what you are seeing. Do not switch off affected machines or delete anything until we have spoken.
10 yearsin cybersecurity
150+companies passed cybersecurity audits
Gold PartnerSophos & Fortinet
Why the first hours of an incident matter
Most incidents start small: one clicked link, one reused password, one unpatched server. Attackers then move quietly, collect passwords and data, and only show themselves when they encrypt files or ask for money. By then many companies have no clear plan, no one owns the decisions and important evidence is lost by well-meant clean-up.
A calm, structured response limits the damage. It stops the attacker spreading, keeps the evidence you need, and gets the business running again from clean systems. For Aramco suppliers and companies holding personal data, it also means telling the right people on time.
- Ransomware: servers and shared files encrypted, backups targeted
- Business email compromise and invoice fraud: fake bank details sent to customers or finance
- Compromised Microsoft 365 accounts: mailbox rules, data theft and phishing from your domain
- Malware on endpoints: infected laptops and servers, remote access tools, data leaks
What we do when you call
Our engineers start with a short triage call to understand what is affected, then work with your IT team on site or remotely. Where an incident needs deeper forensics or vendor-level tools, we bring in our vendor partners’ incident response teams, so you deal with one coordinated team instead of many.
Everything we do is logged: what we found, what we changed and why. That record supports your insurance, legal and regulatory follow-up.
- Isolate infected devices and affected network segments
- Reset compromised accounts, revoke sessions and remove attacker mailbox rules
- Block attacker addresses and domains at the firewall and email gateway
- Preserve logs and evidence before systems are rebuilt
- Restore from clean, tested backups in the right order
What’s included
Triage
We confirm whether it is a real incident, how far it has spread and which systems and data matter most right now.
Containment
Isolate devices, reset accounts, cut attacker access and block malicious traffic at the firewall, without destroying evidence.
Investigation
We review logs, endpoints and mailboxes to find how the attacker got in, what they touched and whether data left the company.
Eradication and recovery
Remove malware and persistence, close the entry point, then restore systems and data from clean backups and watch for return.
Notification support
Clear facts and timelines to help you notify Aramco, SDAIA, customers and insurers where required. You make the decisions; we give you the evidence.
Lessons learned and hardening
A written report with root cause and a prioritised fix list: MFA, patching, backups, monitoring and staff awareness.
How it works
Call or WhatsApp
Tell us what you see. We agree immediate actions by phone so you do not make things worse.
Triage and contain
Our engineers assess scope and stop the spread, bringing in partner incident response teams if needed.
Investigate
We find the entry point, the timeline and what data or accounts were affected.
Recover
Clean systems are restored in business priority order and closely watched for signs of the attacker.
Report and harden
You get a report for management and regulators, and a plan to close the gaps.
Saudi compliance and incident reporting
Saudi rules expect you to detect, handle and report cybersecurity incidents, not only prevent them. We help you meet these duties during an incident and prepare for them before one happens.
- NCA ECC: incident management is a core control area for government bodies, critical sectors and their suppliers. You need a documented process, defined roles and records of how incidents were handled.
- Aramco SACS-210: suppliers must notify Aramco within 24 hours of a cybersecurity incident, keep logs for at least one year and keep tested backups. See our SACS-210 guide.
- PDPL: certain personal data breaches must be reported to the regulator, SDAIA, and in some cases to the people affected. We help you work out what data was involved so you can decide quickly. See PDPL compliance.
Be ready before it happens: an incident response plan, a retainer agreement and a yearly tabletop exercise mean fewer surprises and faster decisions on the day.
Products we use
During incidents and recovery we work with Sophos and Microsoft Defender for endpoint and email investigation, Fortinet and Cisco firewalls for blocking and network containment, and Microsoft Entra for account resets and sign-in review. For ongoing detection after an incident, many customers move to managed detection and response (MDR) delivered with Sophos (see Sophos MDR), and KnowBe4 training to reduce the chance of a repeat.
Frequently asked questions
What should we do first if we think we are under attack?
Call or WhatsApp us on +966 58 236 5619. Do not switch off affected machines, pay any ransom or delete suspicious emails yet. If you can, unplug infected devices from the network but leave them powered on, and change the password of any account you know is compromised from a clean device.
Do you offer a retainer or incident response plan?
Yes. We write an incident response plan that fits your company, with roles, contacts and step-by-step playbooks for ransomware, email fraud and account takeover. A retainer agreement sets the terms in advance so work can start without delay when you need it.
What is a tabletop exercise?
It is a guided workshop where your management and IT team walk through a realistic attack scenario, such as ransomware on a Thursday night. It tests your plan, contacts and decisions without touching any systems, and shows the gaps to fix.
We are an Aramco supplier. What do we need to report?
SACS-210 requires suppliers to notify Aramco within 24 hours of a cybersecurity incident. We help you gather the facts quickly so the notice is accurate, and we support any follow-up questions.
Do we have to report a breach under PDPL?
If personal data was affected, the PDPL may require you to report the breach to SDAIA and, in some cases, inform the people affected. We help you find out what data was involved; for legal advice on your duties, involve your legal adviser.
Can you recover our data after ransomware?
If you have clean, offline or immutable backups, we restore from them in priority order after making sure the attacker is gone. Without good backups, recovery options are limited, which is why we review and test backups as part of hardening.
Get help with an incident or prepare for one
Under attack now? Call or WhatsApp us. For incident response plans, retainers and tabletop exercises, send us a message and we will arrange a free consultation.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
