Saudi cybersecurity: reading the SAR 16.3bn market

Saudi Arabia's cybersecurity market reached SAR 16.3 billion in 2025. That is a useful number for a founder estimating demand or a CTO reviewing supplier capacity. It is not a measure of how well Saudi organisations can withstand an attack.

The National Cybersecurity Authority's 2026 economic-indicators report, published on 14 October, describes spending on cybersecurity products and services by entities operating in the Kingdom. Private-sector buyers accounted for 69% of that spending. The report also gives a separate estimate of the sector's contribution to GDP.

Those figures answer different questions. Keeping them separate makes the report more useful for procurement, investment and operating plans.

Cover: original SultanByte artwork contrasting cybersecurity spending with evidence of operational protection.

A 2026 report about 2025 spending

The publication year is easy to mistake for the measurement year. SAR 16.3 billion is the market figure for 2025, not a forecast for 2026. NCA reports a 10.7% compound annual growth rate between 2023 and 2025. That is a multi-year growth measure, not the increase during 2025 alone.

The previous edition put 2024 spending at SAR 15.2 billion. Comparing those two rounded headline figures produces an increase of approximately 7.2%. This is a calculation from separate published editions, rather than a newly reported NCA annual-growth statistic. Without checking revisions and consistent coverage, it should not be presented as a precise measure of acceleration or slowdown.

For a revenue plan, use the spending total as context. Then estimate the customers your product can serve, their buying cycles and the portion of their budgets your offering could realistically replace. A national market total is not the addressable revenue of an individual security startup.

Private buyers account for most of the market

NCA divides the 2025 total into SAR 11.2 billion of private-sector expenditure and SAR 5.1 billion of government expenditure, representing 69% and 31% respectively. Asharq Al-Awsat's 15 October coverage reports the same breakdown and attributes it to NCA. That corroborates the published figures, but it is not a second independent market survey.

The private-sector share is relevant to commercial planning. It suggests that a supplier's opportunity should not be framed solely around government tenders. It does not reveal how expenditure is distributed between large enterprises, smaller businesses or individual industries. Nor does it tell a new entrant how much is available for new contracts rather than renewals.

A founder should therefore build the sales case from named customer segments. Identify who owns the problem, which existing contract would change and what approval is needed to move spending. Investors should ask for that evidence before treating the national growth rate as a forecast for a portfolio company.

For buyers, the same distinction works in reverse. A growing market does not establish that a particular vendor has the staff, integration experience or support coverage needed for your deployment.

Original infographic: SultanByte. Source: NCA's economic-indicators report published 14 October 2026; spending period 2025. Spending and GDP contribution are separate measures, not amounts to add together.

GDP contribution is not another sales pool

NCA puts the sector's contribution to GDP at approximately SAR 20 billion at current prices. It separates SAR 9.7 billion of direct contribution from cybersecurity product and service providers and SAR 10.3 billion of indirect contribution.

Do not add SAR 20 billion to SAR 16.3 billion and describe the result as the cybersecurity market. The report labels the first as GDP contribution and the second as expenditure. They are different economic measures, not separate customer budgets.

The distinction also limits comparisons across countries. A UAE market forecast from a commercial research firm and Saudi Arabia's official expenditure estimate cannot be ranked confidently without matching their scope, measurement period and definitions. A larger number may reflect a different boundary rather than a larger like-for-like market.

Regional expansion plans need separate country-level customer and delivery assumptions. The Saudi figures do not establish demand in the UAE, Qatar or Egypt, and they do not tell a supplier where a regional support team should sit.

Spending is not a security outcome

Economic reports and cybersecurity indices have different purposes. The ITU's Global Cybersecurity Index measures countries' commitment across legal, technical, organisational, capacity-development and cooperation pillars. It is not a customer-level test of detection or recovery.

Neither a spending total nor a national index establishes that your organisation can restore its critical service after an incident. For that, the buyer needs evidence from its own environment.

NIST's Cybersecurity Framework is intended to help organisations understand and improve their management of cybersecurity risk. Its Organizational Profiles provide a practical way to compare current and target outcomes and identify gaps. This is a planning method, not a substitute for applicable Saudi requirements. NCA separately publishes Essential Cybersecurity Controls and implementation guidance; responsible teams should determine which requirements apply to the actual organisation and service.

For the next renewal, define the operational gap before evaluating another product. A proposed acceptance test might require the team to detect a controlled suspicious action, send the alert to the right responder, contain the affected account and retain the investigation record. Another might require restoring a service from a protected backup and verifying that the recovered application works.

Choose tests that reflect the system being purchased. Document who can authorise disruptive actions, what evidence the supplier must provide and what happens when the test fails. These are proposed procurement checks, not results claimed by the NCA report.

Ask who will operate what you buy

NCA reports that the Kingdom's cybersecurity workforce exceeded 22,000 specialists in 2025. That national headcount does not show how many people are available for your technology stack, shift pattern or industry.

During procurement, ask the supplier to identify the actual delivery roles. Who maintains integrations? Who investigates an alert outside business hours? Which tasks remain with your engineers? A managed-service label should not conceal work that the customer still has to perform.

Require a handover exercise using your escalation process and synthetic test data. Check whether your team can obtain the necessary records without depending on a single supplier employee. Include transition arrangements in the evaluation so the service remains operable if the contract changes.

The report supports a specific conclusion: Saudi Arabia has a substantial cybersecurity spending market, with private entities accounting for most expenditure. Use that evidence to sharpen commercial assumptions. For a purchase decision, require a separate record showing what the proposed service will protect, who will operate it and how its performance will be demonstrated before acceptance.