Saudi Arabia’s cybersecurity market tells two stories simultaneously. The market was valued at nearly $7 billion in 2024 and is projected to reach over $17 billion by 2030.

This trajectory reflects both the scale of digital transformation and the urgency of the threat environment driving it.

But despite all the investment in infrastructure, tools, and technology, the most persistent vulnerability remains stubbornly human. A 2024 survey of 300 IT professionals based in the Kingdom found that 74% of organizations experienced phishing attacks with a notable surge in malware delivered through email attachments and advanced spear phishing campaigns.

The numbers put the challenge in plain terms. AI, enabled phishing methods, targeted emails, fake executive messages, and deepfake voice recordings are bypassing traditional cybersecurity awareness training programs entirely, exploiting user trust rather than technical gaps.

SAMA’s Cyber Security Framework was introduced in direct response to this reality. It recognizes that workforce behavior is not a soft risk that can be addressed through annual training. It is an exposure that requires structured, measurable, and continuous intervention.

SAMA’s Cyber Security Framework places strong emphasis on human, layer controls. Domain 4 specifically requires organizations to implement structured, role, based, and recurring cybersecurity awareness training. This is not a one, time exercise but an ongoing program tied to measurable outcomes.

Regulators are no longer asking whether you ran cybersecurity training. They are asking whether it worked. Can you demonstrate workforce risk reduction? Can you show behavioral change? Do your audit, ready reports reflect real resilience, or just participation rates?

For security teams and CISOs, the compliance burden is shifting from documentation to demonstration. Not surprisingly, many cybersecurity awareness programs still fall short of SAMA requirements for several reasons:

1. Lack of personalization:

Generic, one, size, fits, all cybersecurity awareness training content is delivered across the workforce regardless of role, seniority, or behavioral risk profile, producing equally generic results. A warehouse operator and a finance director face very different threats and yet a single training module is expected to address both.

2. Regional nuances:

Generative AI has removed the language barrier for attackers, where phishing emails and messages in fluent Arabic are now produced at scale with minimal effort. Scams in the Kingdom routinely impersonate Absher, SADAD payment flows, and local institutions. A workforce trained on English, language simulations modelled on Western scenarios is not being prepared for the threats it will actually face. Training should be available in Arabic, with an Arabic right, to, left user interface, and reflect the types of lures employees in the region are likely to see.

3. Local hosting:

Data residency is a compliance requirement for SAMA, regulated enterprises. Training activity, simulation results, and behavioral risk data generated through cybersecurity awareness training needs to be hosted within the Kingdom's borders. A platform that routes sensitive workforce data through offshore infrastructure creates a compliance gap before a single simulation is even run.

4. Regional compliance requirements:

SAMA’s Cyber Security Framework, NCA’s Essential Cybersecurity Controls, and PDPL each carry specific obligations around workforce training, risk documentation, and data handling that off, the, shelf global platforms are not built to address. Compliance in the Kingdom requires a platform that serves its regulatory stack.

Addressing these gaps requires more than a training program. It requires a Human Risk Management+ approach: one that combines regional relevance, regulatory alignment, compliant data infrastructure, and behavioral intelligence into a single, measurable platform.

Understanding where programs fall short is only half the equation. Building one that actually meets SAMA’s requirements demands a different approach across five areas.

SAMA rulebook expectation: SAMA explicitly requires organizations to define, approve, and conduct a cybersecurity awareness program designed to create a positive cybersecurity culture and improve risk, aware behavior.

This mandate is hard to fulfill when training stops at the inbox. Attackers now use email, SMS, voice calls, Teams app, QR codes, and messaging platforms such as WhatsApp, channels that many traditional cyber security user awareness training programs still overlook. A workforce that can identify a suspicious email but has never encountered a vishing attempt or a malicious QR code may develop a false sense of security. When a real attack occurs, that gap becomes obvious.

Solution: Effective cybersecurity training must reflect the environments employees encounter every day. Choose a Human Risk Management platform where simulations can span attacks across multiple vectors, remain contextually relevant, and mirror the tactics used by modern threat actors.

SAMA rulebook expectation: SAMA specifies that awareness activities should be conducted periodically and throughout the year, not just front, loaded into an annual training event and forgotten until the next audit cycle.

The implication is straightforward. A single compliance training session, however well, designed, cannot keep pace with a threat landscape that evolves week to week. Organizations need to sustain workforce vigilance through regular awareness campaigns, phishing simulations, newsletters, microlearning modules, cybersecurity month initiatives, and emerging threat alerts that reach employees at the moments that matter instead of just once a year when renewal is due.

Solution: Continuous engagement is what separates a program that builds genuine resilience from one that satisfies a checkbox. Choose a Human Risk Management platform that sustains that engagement through always, on simulations, adaptive nudges, and real, time threat alerts, not a once, a, year renewal.

SAMA rulebook expectation: SAMA requires organizations to tailor awareness activities to different target groups, recognizing that a finance director, a developer, and a frontline employee face fundamentally different threat surfaces and need fundamentally different training.

At the awareness level, this means executives receive content focused on business risk, governance, and fraud; employees are trained on phishing recognition, password hygiene, and data protection; and developers engage with secure coding practices relevant to their daily work. A single module delivered uniformly across the organization does not meet this requirement. It merely creates the appearance of compliance.

Beyond awareness, SAMA goes further by requiring specialized cybersecurity training for staff based on their specific responsibilities. Cybersecurity teams, developers, technical staff, risk assessment teams, and other key organizational roles each carry distinct security obligations that generic training cannot address. The framework is explicit: role, based depth is not optional.

Solution: A Human Risk Management+ platform enables role, based learning paths that adapt to each individual’s responsibilities, risk profile, and behavior, ensuring that every employee, from the C, suite to the developer floor, receives training that is relevant to the threats they will actually face.

SAMA rulebook expectation: SAMA requires that cybersecurity awareness programs include Arabic, language training materials and address Saudi, specific cyber threats as a compliance expectation, not an optional enhancement.

For GCC enterprises, localization has to be a precondition for adoption. A platform that employees can’t navigate comfortably in Arabic, or that simulates attack scenarios irrelevant to the regional context, will see engagement drop off almost immediately after rollout. While the compliance numbers may hold, the behavioral outcomes won’t.

Solution: Saudi enterprises require Human Risk Management platforms that are built with GCC realities in mind: Arabic, first interfaces, locally hosted data to support data residency requirements, and training content calibrated to the regulatory environment, business culture, and threat landscape of the region.

SAMA rulebook expectation: SAMA requires organizations to evaluate awareness programs and measure their effectiveness and assigns direct accountability for this to cybersecurity leadership.

For CISOs, awareness is a governance and risk management function, reportable through KPIs and KRIs. What that means in practice is that auditors will look for evidence like training completion rates, phishing click rates, reporting rates, knowledge assessment scores, risk reduction trends, and program participation.

For CISOs managing SAMA audits, one of the most practical challenges is translating workforce security activity into documentation that auditors can actually evaluate. Genuine audit readiness requires centralized reporting that maps directly to framework requirements, tracks workforce risk across individuals and departments, and generates documentation without extensive manual effort. It means converting simulation results, training activity, and behavioral assessments into a clear and reviewable compliance record.

This is not a luxury for large enterprises. It is, increasingly, a minimum expectation for any SAMA member organization that takes its regulatory obligations seriously.

Solution: A Human Risk Management+ platform converts training activity, simulation results, and behavioral risk data into centralized, audit, ready documentation mapped directly to SAMA framework requirements and reportable through KPIs and KRIs without extensive manual effort.

Saudi Arabia’s Vision 2030 has accelerated digital transformation across the BFSI sector landscape. With that comes expanded attack surface and a larger pool of employees navigating digital environments at significantly greater scale.

SAMA’s framework recognizes this. The cybersecurity awareness training requirements it sets out are not designed to punish enterprises. They are designed to help them catch up to a threat environment that has been evolving for years. The enterprises that take this seriously by investing in adaptive, intelligent, multi, vector cybersecurity awareness training programs will be harder to breach.

SimuPhish was built to address this challenge. As a Human Risk Management+ platform designed for regulated industries, it combines AI, powered cybersecurity awareness training with multi, vector phishing simulations, behavioral intelligence, and compliance, focused reporting in a single platform built for the GCC. Arabic, first experiences, regionally relevant threat scenarios, and audit, ready dashboards mean enterprises don’t have to choose between regulatory compliance and genuine workforce resilience.