TIBER-SA Red Team Testing Guide: Preparing for SAMA’s Intelligence-Led Exercises

This TIBER-SA red team testing guide explains programme phases, governance roles, scope decisions, and how CyberSilo supports Saudi banks, insurers, and payment institutions with threat intelligence, red team coordination, and agentic pentesting aligned to modern attack paths. Use the SAMA compliance hub for broader CSF context.

How TIBER-SA differs from traditional penetration testing

Traditional pentests often focus on scoped IP ranges, known credentials, and vulnerability scanning with a short reporting window. TIBER-SA introduces:

• Threat intelligence feeding scenario design based on sector-specific adversaries.
• Multiple attack teams—typically red (attack), blue (internal detection), and white (coordination)—operating under strict rules of engagement.
• Critical functions as targets (payments, securities settlement, core banking) rather than arbitrary hosts.
• Extended timelines allowing stealth, persistence, and lateral movement consistent with realistic campaigns.
• Structured reporting to regulators and senior leadership with remediation expectations.

Programme phases and governance

While institution-specific charters vary, TIBER-style programmes generally progress through:

1. Preparation and threat intelligence — collect sector and institution-specific intelligence, define threat actor personas, and agree critical functions.
2. Scenario development — translate intelligence into test scenarios, targets, and constraints approved by white team leadership.
3. Exercise execution — red team operations within agreed hours, legal boundaries, and safety controls; blue team operates normally unless escalation protocols trigger.
4. Closure and reporting — hot wash, formal report, remediation plans, and regulatory submission timelines per SAMA guidance.
5. Remediation and retesting — track control improvements; some programmes include follow-on validation.

Assign an internal white team lead with authority to arbitrate scope disputes and a crisis communications liaison before execution—not after the first simulated breach headline.

Roles: red, blue, and white teams

• Red team simulates adversaries using agreed TTPs; may include external specialists and platform experts.
• Blue team is the institution’s detection and response function—SOC, CERT, and relevant IT operations—measured on time-to-detect and time-to-respond.
• White team coordinates objectives, ensures legal and operational safety, and adjudicates out-of-scope findings.

Scoping critical functions and infrastructure

Scope documents should name critical functions, supporting systems, and explicit exclusions (production destruction, social engineering of retail customers if prohibited, third-party systems requiring separate consent). Include:

• On-premise and cloud workloads supporting payments and trading.
• Identity systems governing privileged administrators.
• Email and collaboration platforms used in treasury operations.
• Remote access and vendor connectivity paths.
• Security operations tooling itself—red teams often test detection stacks.

Map scope to SAMA CSF domains so remediation feeds existing compliance programs rather than parallel slide decks.

Threat intelligence and scenario realism

Intelligence-led testing fails when scenarios recycle generic ransomware playbooks unrelated to Gulf financial threats. Quality programmes incorporate:

• Sector ISAC and government advisories relevant to KSA financial infrastructure.
• Historical incident patterns affecting regional banks and SWIFT-connected environments.
• Insider and supplier compromise vectors common in large financial institutions.
• Living-off-the-land techniques that evade signature-heavy defenses.

CyberSilo supports intelligence gathering and scenario workshops that align red team objectives with institution risk registers—without prematurely disclosing TTPs to blue teams against programme rules.

Agentic pentesting and modern attack surfaces

Cloud-native stacks, API-first banking channels, and DevOps pipelines expand attack surface faster than annual pentests can catalog. Agentic pentesting augments human red teams by systematically exploring API abuse paths, misconfigurations, and chained weaknesses—under human approval gates where required—so TIBER-SA exercises reflect 2026 attack tradecraft, not decade-old scan reports.

Use agentic tooling primarily in preparation and purple-team hardening phases; live TIBER execution still follows white team rules and regulatory notification requirements.

Coordinating with the SOC and SIEM

Blue team measurement depends on quality telemetry. Before TIBER-SA, validate that ThreatHawk SIEM or incumbent platforms ingest cloud control plane logs, identity events, and east-west traffic samples relevant to critical functions. After-action reviews should cite which detections fired, which failed, and which log gaps delayed response.

Remediation planning and regulatory follow-through

Reports typically categorize findings by severity and map them to control owners. Successful institutions:

• Assign remediation owners with dates tied to risk acceptance processes.
• Fund detection engineering backlogs based on missed TTPs.
• Update incident response playbooks with TIBER-specific communication trees.
• Feed lessons into board cyber committees with measurable KPIs.

Link remediation tasks to Compliance Standards Automation control records so SAMA CSF assessments later reference the same improvement trail.

Preparing your organization: checklist

• Executive sponsorship and legal review of rules of engagement.
• Critical function map validated by business lines, not IT alone.
• Threat intelligence briefings approved by white team.
• SOC staffing and shift plans during exercise windows.
• Backup and recovery safeguards if scenarios approach production risk thresholds.
• External communications guardrails if simulated leaks touch media monitoring.

Our conclusion

TIBER-SA is the capstone adversary simulation for Saudi financial institutions serious about SAMA-aligned resilience. Treat it as an intelligence-led programme spanning governance, red team execution, and measurable blue team performance—not a one-off pentest PDF. Use the SAMA hub, prepare scope and telemetry early, and engage CyberSilo for TIBER readiness—including agentic pentesting and post-exercise remediation planning. Contact CyberSilo to align your next exercise with SAMA expectations.