Mutabaqa · Pitch Deck
Cybersecurity
Mutabaqaمطابقة
Turn ECC-2, SAMA CSF, and PDPL assessments into a living control register.
neuriya.ai — Sovereign, Arabic-first enterprise AI
Problem
Compliance teams re-do the same evidence hunt every audit cycle
- ECC-2, SAMA CSF, PDPL, and CCC controls are typically tracked across four separate spreadsheets, with no single owner accountable when a control silently lapses.
- Assessment evidence lives in email threads and shared drives, so auditors get a scramble of screenshots and unlinked PDFs instead of a chain of proof.
- Findings from an external assessment get logged once, then forgotten — nothing forces the fix into a tracked remediation task with a due date.
- Without a shared calendar, the compliance team often first hears about an upcoming external review the week it's due, not the weeks before.
Solution
A living control register replaces the pre-audit spreadsheet scramble
Product
Mutabaqa in action
How it works
From first touch to outcome
Import your frameworks
ECC-2, SAMA CSF, PDPL, and CCC controls load in as a structured register from day one.
Assign owners
Every control gets a named owner and a review cadence — no more orphaned controls.
Attach evidence
Owners upload evidence directly against the control it supports.
Walk into audits ready
Assessors see a live, evidenced register instead of a scramble the week before.
Market
Sizing the opportunity
- TAM — $2.1B. GCC governance, risk & compliance (GRC) software market
- SAM — $260M. Saudi cybersecurity compliance & GRC platform market
- SOM — $16M. 3-year obtainable share via NCA-regulated enterprise and financial-sector customers
NCA's ECC-2 and SAMA's CSF frameworks are mandatory for a growing list of regulated entities, and PDPL enforcement is ramping up — pushing compliance teams to replace spreadsheet-based tracking with an auditable system of record, not treat it as optional overhead.
Business model
How Mutabaqa makes money
Per-entity annual subscription
Priced per regulated entity and tiered by the number of frameworks tracked (ECC-2, SAMA CSF, PDPL, CCC).
Framework add-on modules
Additional compliance frameworks beyond the base package sold as add-on modules.
Implementation & framework-mapping fee
One-time fee to import an organization's existing controls and map them into the register.
Revenue streams
Where the revenue actually comes from
Competition
Where we win
Our edge
- Purpose-built control library for ECC-2, SAMA CSF, PDPL, and CCC, not a generic GRC template retrofitted with local frameworks.
- Evidence and ownership are structural to the product, not an optional field nobody fills in.
- Sovereign hosting for compliance evidence — often an organization's most sensitive documentation — as a default, not an enterprise add-on.
- Founding team combines Saudi enterprise delivery experience with hands-on compliance and security engineering.
Traction
Early validation, built for pilot readiness
- Full compliance platform experience designed and built end-to-end: control register, evidence attachment, owner accountability, and assessment calendar.
- Architecture pre-aligned to NCA ECC-2, SAMA CSF, PDPL, and CCC.
- Actively selecting design-partner compliance teams for a first pilot cohort.
Go-to-market
Land with one framework, expand to full compliance coverage
- 1Land with 2-3 design-partner compliance teams, starting with their single most urgent framework (typically ECC-2 or SAMA CSF).
- 2Prove audit-readiness time savings over a pilot assessment cycle, then expand to the organization's full framework set.
- 3Expand through NCA- and SAMA-regulated sector networks and compliance-advisory referral relationships.
Team
Built by operators, not just builders
The ask
Raising a seed round to reach first design-partner compliance teams
We're raising to fund framework-mapping tooling, integration with common evidence sources, and the core team through first-revenue pilot deployments.