Ribat · Pitch Deck
Industrial · OT SECURITY OPERATIONS
Ribatرباط
A 24/7 security operations center built for operational technology, not repurposed from IT.
neuriya.ai — Sovereign, Arabic-first enterprise AI
Problem
OT networks are watched with IT tools, or not watched at all
- Most Saudi industrial sites either have no dedicated OT monitoring or route ICS/SCADA traffic through an IT SOC that doesn't understand process context, generating noise instead of signal.
- Alerts get triaged without operational context, so a real ICS threat and a benign PLC firmware update look identical on a generic dashboard.
- Incidents are frequently handled off-system over phone calls and messaging apps, leaving no auditable case history for post-incident review or regulator inquiry.
- Command has no single view of which sites are stable, which need attention, and which have an active incident — status lives in separate site-level reports.
Solution
A SOC built OT-native, from sensor placement to incident close
Product
Ribat in action
How it works
From first touch to outcome
Design
Sensor placement, detection logic, and escalation paths are designed around each site’s actual OT architecture.
Monitor
Traffic and events across every connected site are watched continuously by an OT-trained analyst team.
Respond
Confirmed incidents move through containment with clear ownership, tracked on one incident board.
Report
Every incident closes with a documented case file, ready for compliance and executive review.
Market
Sizing the opportunity
- TAM — $1.5B. MENA OT/ICS managed security services market
- SAM — $170M. Saudi OT SOC & managed-detection market
- SOM — $12M. 3-year obtainable share via design-partner operators
NCA's ECC-2 and OTCC controls now expect continuous OT monitoring, not periodic assessment alone, pushing Saudi critical-infrastructure operators toward a dedicated OT SOC capability most don't currently have in-house.
Business model
How Ribat makes money
Per-site SOC subscription
Recurring monthly fee priced by number of monitored sites and connected OT assets.
Incident-response retainer
Add-on tier for guaranteed response-time commitments on confirmed incidents.
SOC design & onboarding fee
One-time fee to design sensor placement, detection tuning, and runbooks for each site.
Revenue streams
Where the revenue actually comes from
Competition
Where we win
Our edge
- Detection logic built OT-native from the start, tuned to ICS/SCADA protocols instead of adapted from IT threat signatures.
- Full incident lifecycle tracked on one board — nothing handled off-system over calls or messaging apps.
- In-Kingdom SOC operation and reporting mapped directly to NCA ECC-2 and OTCC structure, ready for regulator review.
- Founding team combines Saudi critical-infrastructure operations experience with OT security engineering and SOC operations.
Traction
Early validation, built for pilot readiness
- Full OT SOC product experience built end-to-end: OT SOC overview dashboard, incident response board, and case audit trail.
- Architecture pre-aligned to NCA OTCC, IEC 62443, NCA ECC-2, and ISO 27001.
- Actively selecting design-partner operators for a first OT SOC deployment cohort.
Go-to-market
Land on one site's monitoring, expand to fleet-wide coverage
- 1Land with 1-2 design-partner operators, starting with monitoring on a single high-priority site.
- 2Prove detection accuracy and incident-response time over a pilot quarter against current coverage.
- 3Expand across the operator's full site portfolio and into adjacent NCA-regulated sectors.
Team
Built by operators, not just builders
The ask
Raising a seed round to reach first OT SOC pilots
We're raising to fund OT-native detection-logic development, in-Kingdom SOC infrastructure, and the core analyst and engineering team through first-revenue pilot deployments.