Haris · Pitch Deck
Cybersecurity
Harisحارس
24/7 in-Kingdom detection and response, without building your own SOC.
neuriya.ai — Sovereign, Arabic-first enterprise AI
Problem
Regulated Saudi enterprises can't staff the 24/7 SOC they're required to run
- Round-the-clock coverage takes 8-12+ analysts across rotating shifts, against a Saudi cybersecurity talent pool that can't fill existing SOC vacancies today.
- NCA ECC-2 and SAMA CSF require continuous monitoring and tight incident-notification windows, but most mid-market organizations only staff business hours.
- Generic offshore MSSPs process Saudi enterprise telemetry outside the Kingdom, creating a direct conflict with data-residency and regulatory expectations.
- Where a SOC exists at all, alerts arrive disconnected from a real incident lifecycle — nothing tracks detection through to the compliance notification a regulator actually asks for.
Solution
A sovereign, always-on SOC teams can plug into instead of build
Product
Haris in action
How it works
From first touch to outcome
Connect your estate
Log sources, EDR, and network telemetry connect into the SOC within days, not months.
Detect
Around-the-clock monitoring flags anomalies against tuned, environment-specific rules.
Respond
Analysts contain and remediate, with every action logged against the incident.
Report
A compliance-ready report closes the loop for your board and your regulator.
Market
Sizing the opportunity
- TAM — $3.2B. GCC managed security services & MDR market
- SAM — $420M. Saudi in-Kingdom managed SOC & MDR segment
- SOM — $25M. 3-year obtainable share via ECC-2/SAMA-regulated mid-market and enterprise pilots
NCA ECC-2's continuous-monitoring mandate for government and critical-sector entities, alongside SAMA CSF for financial institutions, is turning always-on detection from a best practice into a compliance floor — one most regulated organizations can't build in-house given the Kingdom's cybersecurity talent shortfall.
Business model
How Haris makes money
Tiered managed-service retainer
Monthly subscription priced by assets and endpoints monitored, scaling with the customer's estate.
Onboarding & tuning fee
A one-time engagement fee to connect log sources, EDR, and network telemetry and tune detection to the environment.
Incident-response surge retainer
A premium tier for guaranteed surge capacity and hands-on-keyboard response during major incidents.
Revenue streams
Where the revenue actually comes from
Competition
Where we win
Our edge
- Sovereign in-Kingdom SOC staffed by Saudi-based analysts — a hard requirement, not a checkbox, for ECC-2/SAMA/PDPL-regulated entities.
- Full incident lifecycle built into the product from detection through regulator notification, not stitched together from a SIEM, a ticketing tool, and a spreadsheet.
- NCA and SAMA notification timelines encoded directly into the reporting workflow, so compliance is a byproduct of using the product, not a separate project.
- Founding team combines Saudi enterprise security delivery experience with AI-native product engineering, letting detection scale without linearly scaling analyst headcount.
Traction
Early validation, built for pilot readiness
- Full SOC product experience designed and built end-to-end: monitoring dashboard, incident log, incident detail, and escalation workflow.
- Architecture pre-aligned to NCA ECC-2, SAMA CSF, PDPL, and ISO 27001.
- Actively selecting design-partner enterprises for a first pilot cohort.
Go-to-market
Regulated mid-market first, channel-expanded from there
- 1Land with 1-2 design-partner enterprises in regulated sectors (finance, government-adjacent) around Riyadh for the first pilot cohort.
- 2Prove detection and response outcomes over a pilot period, then package as a tiered managed-service retainer.
- 3Expand via NCA/SAMA-adjacent channel relationships — compliance auditors, MSSP partners, and systems integrators already selling into regulated accounts.
Team
Built by operators, not just builders
The ask
Raising a seed round to reach first SOC pilots
We're raising to fund SOC build-out — analyst staffing, threat-intel tooling, and detection engineering — alongside NCA/SAMA alignment work and the design-partner pipeline through first-revenue.