No junior handoffs
Every engagement is scoped, executed and reported by senior practitioners. The consultant who breaks in is the person who briefs your leadership.
Offensive security · Muscat, Oman
Evans-IT is a penetration testing consultancy serving enterprises across Oman, the GCC and globally. Precise, adversary-grade testing. Findings your board can act on.
Continuous sweep · every surface charted
Why we exist
Oman's oldest trade was navigation, reading hostile waters better than anyone else. We do the same with your attack surface: chart it, test it, and hand you the map.
Every engagement is scoped, executed and reported by senior practitioners. The consultant who breaks in is the person who briefs your leadership.
Reproducible attack paths, clear business impact, and remediation your engineers can execute. Written for auditors, boards and regulators alike.
We operate under strict confidentiality across regulated industries - from financial institutions to critical national infrastructure.
Capabilities
Scroll through the deck. Each capability stands alone or combines into a full offensive-security programme.
Capability 01/ OFFENSIVE
Adversary-grade testing across your full estate - external perimeter, internal networks, web and mobile applications, and wireless. Real attack paths, demonstrated safely, documented precisely.
Capability 02/ ASSESS
A structured, framework-aligned review of your security programme - people, process and technology - benchmarked against your sector and regulatory landscape, with a prioritised roadmap.
Capability 03/ ADVISE
Senior security leadership on retainer. Strategy, governance, vendor scrutiny and incident readiness - without the cost of a full-time executive hire.
Capability 04/ TRAIN
Hands-on offensive and defensive training delivered by practitioners - including our partnership with Black Hat MEA and accredited certification pathways for your teams.
Capability 05/ EXTEND
Specialist services delivered with vetted partners under our oversight - extending your programme without extending your vendor list.
Method
We map what an adversary sees: exposed services, leaked credentials, forgotten assets, and the people most likely to be targeted.
Controlled exploitation of the weakest viable entry point - technical or human - with every action logged and authorised in advance.
From a foothold to the assets that matter: privilege escalation, lateral movement, and the quiet paths your monitoring never flagged.
We demonstrate real impact against agreed objectives - data access, financial systems, domain control - without ever causing harm.
Two documents, two audiences: an executive narrative of business risk, and a technical annex with reproducible steps and remediation. Then we brief both rooms.
Community partner
968Sec is Oman's largest cybersecurity community, built on live demonstrations, direct questions and zero vendor theatre. We back it because the region's security community deserves a stage that runs on substance.
Visit 968sec.comStudents requiring support on research, graduates looking for placements, or questions on trends.
Technical sessions, workshops, trainings.
Reach
23.5880° N · 58.3829° E
Muscat - Headquarters
Local presence, and delivery aligned with national regulatory frameworks.
GULF COOPERATION COUNCIL
Regional delivery
Engagements across the Gulf, with fluency in the region's regulators, sectors and sensitivities.
51.5072° N · 0.1276° W
International delivery
Testing and advisory for UK enterprises, aligned with recognised British standards and frameworks.
UNITED STATES
International delivery
Remote engagements for US clients, from scoping through to executive debrief.
Start a conversation
Tell us what you're protecting. We'll come back with a scoped, senior-led proposal.
or write to hello@evans-it.net