Exotec launches sovereign cyber-operations platform: Saudi operation centers between isolation requirements and AI independence

Saudi tech company Exotec, based in Riyadh, announced the development of its SOC AI platform designed to automate cyber security operations center processes, aimed at enabling institutions to monitor, investigate and respond to digital threats while keeping sensitive data and critical decisions under direct operational control. The platform comes in response to the mounting challenges faced by security operations centers dealing with a massive daily alert stream and fragmented workflows across separate security tools such as security information and event management platforms and endpoint protection solutions, which continuously pressure monitoring teams and increase the need to introduce AI without incurring operational risks or compromising data sovereignty.

The platform architecture is based on breaking down the security incident handling cycle into four successive stages: automated alert aggregationThe platform architecture is based on breaking down the security incident handling cycle into four successive stages: automated alert aggregation, analysis, formulation of response procedures, and generation of comprehensive reports and audit logs.The bet here is not to replace the security analyst but to establish a human oversight model, with AI enriching the context of attacks, classifying them, and proposing response steps, while analysts retain decision authority and final approval for sensitive measures.The company's CEO, Ghanam Al-Ghanam, explains that the approach focuses on enhancing the security team's capabilities without exempting responsible staff from accountability, and on establishing a clear path for transparency and responsibility so that critical decisions do not become hidden processes within closed algorithms.

The most pivotal point in the platform's technical architecture is the flexibility of deployment options, which enable operation via the cloud, within the enterprise's data centers, or through hybrid environments, in addition to supporting completely offline operation.This isolated approach relies on local artificial-intelligence models that do not require a continuous connection to any external cloud services, and it breaks the reliance of smart analytics tools on international clouds.This architecture specifically targets sensitive sectors such as defense, energy, utilities, critical infrastructure, and government institutions, which are regulatorily prohibited from routing their operational data or audit logs through open networks.

The platform was designed to fit the realities of staff and the operating environment in the Saudi and Gulf markets, supporting work interfaces in Arabic and right-to-left reading paths alongside English, which reduces operational friction for national monitoring teams. Additionally, the design took into account compliance requirements issued by the National Cybersecurity Authority, such as basic cybersecurity controls and other national legislation on data localization and audit-log documentation, making the preparation of digital-evidence reports for regulatory and governance reviews an integrated part of the daily investigation workflow rather than a later documentation burden.

What we see here goes beyond merely launching a new tool; it embodies a practical shift in cybersecurity infrastructure priorities across the Gulf, Egypt, and the region as a whole. For chief technology officers and information security officers, this step means that AI software selection criteria will no longer be limited to response speed or classification accuracy, but will be conditioned on the engines’ ability to run locally within the organization without any leakage to external clouds. This trajectory places cybersecurity engineers in a position where they must acquire skills that combine managing locally-inferred models with controlling independent workflows, and it puts direct pressure on international security-solution providers to adjust their platforms to enable network isolation and full compliance with local digital sovereignty.