Skip to content
SUNKAR
An agentic cybersecurity team · built for Saudi Arabia

The falcon that sees first.

Your security team, delivered as software.

Around the clockYou approve every fixData stays in the Kingdom

Sunkar watches your cloud, servers and AI continuously, shows you how you would be breached, drafts the fix for your approval, and keeps you provably compliant with NCA, SAMA and PDPL, year after year.

Sign in
  • Read-only access, configuration only
  • Your data stays in the Kingdom
  • Arabic and English, natively
POSTURE72/ 100
Internet Pivot BlockedYour safeguards in layers. The attack is stopped before it reaches what matters.Live posture of one account, at a glance
Measured on a live account

Real numbers from a real account.

53
security checks

each one deterministic and tested

263
automated tests

run on every release

4
urgency bands

imminent · elevated · moderate · low

0
bytes of your data leave

configuration only, by design

Measured on a live production account during a pilot, not estimates.

Six specialists, on your account every day.
The team

Six specialists, on your account every day.

A cartographer maps your estate, a red team finds the ways in, triage ranks what matters, a remediation engineer drafts the fix, a compliance officer keeps the evidence current, and a virtual CISO explains it all in plain language. None of them can change anything without your approval.

  1. 01

    Cartographer

    Builds the living model of your cloud, identities, and their links

  2. 02

    Red Team

    Traces how an attacker reaches an asset from the internet

  3. 03

    Triage

    Prioritizes what truly matters in your environment

  4. 04

    Remediation Engineer

    Writes the reversible fix — never applies it without you

  5. 05

    Compliance

    Maps findings to your regulatory frameworks

  6. 06

    Virtual CISO

    Briefs you and answers — grounded only on verified facts

These agents reason and draft — they never invent a finding, and never change anything without your approval.

It secures your AI, too.
AI security

It secures your AI, too.

Sunkar finds every AI asset across your clouds, from models and endpoints to agents and the identities that can reach them, using configuration alone, and tells you what is exposed.

  • AWS, Azure and Google Cloud

    Reads AI-service configuration across the clouds where Saudi AI actually runs.

  • Configuration only

    Sees endpoints, keys and reachable tools, never your prompts, data or model weights.

  • Fixes you approve

    Drafts an access fix for anything exposed. It is applied only with a named approval.

Discovered AI assetsAWS · AZURE OPENAI

  • Azure OpenAI deployment

    AZURE
    config only

  • Bedrock model endpoint

    AWS
    config only

  • MCP server

    AWS
    config only

  • Non-human identity

    AZURE
    config only
Not a list of findings. The route an attacker would take.
Attack paths

Not a list of findings. The route an attacker would take.

Sunkar reconstructs the real path from the internet to your most valuable asset and ranks every finding by how exploitable it is today. You fix the five that matter, not the five hundred that do not.

Exploitability rankingExploitability
  • Imminent4/4

    internet-reachable, exploit ready

  • Elevated3/4

    one pivot from exposure

  • Moderate2/4

    guarded, conditions apply

  • Low1/4

    contained, low urgency

Reconstructed attack path

Your data stays in the Kingdom.
Data residency

Your data stays in the Kingdom.

Sunkar runs in Saudi Arabia, reads your cloud configuration through a read-only role, and never touches the data inside your systems. On the Sovereign package the whole platform runs inside your own cloud.

Inside your boundary
  • Cloud configuration (read-only)
  • The reasoning model
  • Verified findings
  • Drafted, reversible fixes
  • The tamper-evident audit trail
Everything else

No one outside your organisation receives your environment.

OpenAI · Anthropic · any other cloud

No data leaves

Read-only, configuration only

Sunkar reads how your cloud is set up, never the data inside it.

In the Kingdom by default

Hosted in Saudi Arabia, or inside your own cloud on the Sovereign package.

Approved by you, reversible

Every fix is drafted, approved by a named person, recorded, and reversible.

Nothing changes until you say so.
You approve every change

Nothing changes until you say so.

Every fix goes through the same four steps: drafted, approved by a named person, applied exactly as previewed, and reversible. Each step is recorded in a tamper-evident audit trail.

  1. 1

    Drafted

    Sunkar writes the change. It is a preview; nothing runs.

  2. 2

    Approved

    A named person approves it, with the reason on record.

  3. 3

    Applied

    Only now does it run, exactly as previewed.

  4. 4

    Reversible

    Every applied change carries its own rollback.

Recorded · tamper-evident
Arabic and English

Reads naturally in both languages.

Sunkar is built bilingual, not translated. Findings, briefings, fixes and reports read naturally in Arabic and English, with full right-to-left layout.

EN

The falcon that sees first.

AR

الصقر الذي يرى أولاً

Compliance

Evidence in the language of your auditor.

Every finding maps to the controls your auditors ask about, so the evidence and the fixes are ready when the questionnaire arrives.

  • SAMA CSF
  • NCA ECC
  • ISO 27001
  • SOC 2
A security team at every size, priced in riyals, hosted in the Kingdom.
Packages

A security team at every size, priced in riyals, hosted in the Kingdom.

Start with a free Readout of one account. Every paid package includes continuous scanning, Arabic and English evidence, and fixes drafted for your approval, never applied without it.

  • Essentials

    Small businesses, 10 to 100 staff

    SAR29,000/ yearor SAR 2,900 / month
    cloud accounts
    2
    managed assets
    300
    • Weekly scans, fixes drafted for your approval
    • PDPL and NCA baseline compliance, ready for tenders
    • Compliance kept current all year, with an audit trail
    • Ask Sunkar anything about your account; executive report in Arabic
  • Most chosen

    Growth

    Mid-sized companies, 100 to 500 staff

    SAR300,000/ yearor SAR 25,000 / month
    cloud accounts
    5
    managed assets
    1,500
    • Daily scans with drift alerts; full NCA ECC and SAMA coverage
    • Evidence in Arabic and English, AI security, single sign-on
    • Server vulnerabilities and patching, data kept in the Kingdom· on the published roadmap
    • Priority support and a quarterly review with your team

  • Sovereign

    Regulated enterprises, banks and government

    fromSAR1,500,000/ yearquoted
    cloud accounts
    15
    managed assets
    8,000
    • Runs inside your own cloud, dedicated and isolated
    • Local AI only; no external model ever sees your environment
    • A named security lead, a service-level agreement, regulator liaison
    • Fixes applied on your approval and reversible; audit export for regulators

Readout

Free. One read-only scan of one account: the attack paths, the top fixes drafted, a PDPL gap summary and an executive report in Arabic and English. No card, nothing to install, nothing changed.

Partner, for MSSPs and consultancies

Run Sunkar for your own clients under your brand: one console, a separate workspace per client, and a fee per managed client.

Prices exclude 15% VAT. Invoiced annually; monthly invoicing available on Essentials and Growth. No card required.

Get started

See your own account in one scan.

The Readout is free: one account, one read-only scan, and a report in Arabic and English. Nothing to install and nothing changed.

Sign in