Skip to content

SOVENTRA / SHAHIN AI

GRC solutions in Saudi Arabia

Clear ownership. Connected evidence.

Bring governance, risk and compliance into a working programme with Soventra SHAHIN AI and BrightGate’s local implementation expertise. Connect the requirement, the accountable owner and the evidence behind each decision.

Request a focused demo ↗Watch the overview ▷

Arabic & EnglishGovernance · Risk · ComplianceSaudi implementation services

THE SOLUTION

Explore the 12 business areas listed in SHAHIN AI’s official GRC catalogue, from governance and risk to measurement and integrations. BrightGate shapes the implementation around your organisation’s priorities. Area 12 is experimental and excluded from the committed production scope.

For GRC and compliance leaders, risk teams, internal audit, cybersecurity owners and executives who need a reviewable view of responsibilities and progress.

01

Governance & organisational management

Give policies, decisions and exceptions a clear business context and accountable owner.

Explore features and implementation

Catalogue features
Operating context; organisational objectives and issues; risk acceptances; exceptions; validation flows; policy documents; document management.

BrightGate helps agree the entities in scope, policy owners, approval responsibilities and review dates. The objective is a usable decision record that connects a policy or exception to the reason it exists.

02

Risk management

Connect risk scenarios, business impact, assessment and treatment in one reviewable process.

Explore features and implementation

Catalogue features
Inherent risk; EBIOS RM; quantitative risk studies; scoring assistance; business impact analysis (BIA); X-Rays.

BrightGate scopes the risk taxonomy, scoring criteria and acceptance authority with your team. Review inherent, current and residual exposure where enabled, then assign treatment and review responsibilities. Advanced methods are demonstrated against an agreed use case.

03

Compliance, audit & assurance

Follow an obligation through controls, assessment, evidence and corrective action.

Explore features and implementation

Catalogue features
Compliance assessments; audit-tree inheritance; auditee mode; control plans; follow-up; campaigns; object audit trails.

BrightGate helps structure the audit population, evidence requests and review responsibilities. For ECC or another applicable framework, agree what each assessment result means and what evidence is sufficient before producing a management report.

04

Security & vulnerability management

Bring security issues into the governance and remediation process.

Explore features and implementation

Catalogue features
Incident records; vulnerabilities; security advisories; Common Weakness Enumeration (CWE) references.

BrightGate defines how findings from your security tools enter the register, who reviews severity and how treatment is followed. GRC records and governs these issues; vulnerability scanning and SOC monitoring are separately scoped capabilities.

05

Third-party risk management

Relate supplier exposure to the service provided and the contractual relationship.

Explore features and implementation

Catalogue features
Third-party risk management (TPRM); contract records.

BrightGate helps segment suppliers by criticality and agree assessment questions, evidence and owners. Define onboarding, reassessment and contract-review checkpoints so your team knows when a supplier risk requires follow-up.

06

Privacy & data protection

Organise personal-data records and privacy work around accountable business processes.

Explore features and implementation

Catalogue features
Privacy records; personal data; processing purposes; rights requests; data breaches.

BrightGate helps define record ownership, the information needed for a rights request and the escalation route for a breach. Your privacy and legal teams retain responsibility for statutory interpretation, reporting obligations and applicable deadlines.

07

Projects, tasks & collaboration

Turn the GRC programme into work that people can own and follow through.

Explore features and implementation

Catalogue features
Project management; tasks; comments; guided journeys.

BrightGate helps organise implementation and remediation work into manageable stages. Agree task ownership, due dates and review checkpoints, with a consistent place for the context behind a decision or action.

08

Analytics, metrics & reporting

Give management a defined, evidence-based view of progress and exposure.

Explore features and implementation

Catalogue features
Reports; measurement and metrology; advanced analytics; configurable dashboards and custom metrics.

BrightGate works with you to define KPIs and KRIs, source records, thresholds and review frequency. The examples below are reporting designs to configure and validate, rather than a claim that every indicator is a prebuilt dashboard.

09

AI & intelligent assistance

Use assistance within the data, permission and review boundaries your organisation approves.

Explore features and implementation

Catalogue features
Chat mode; optional AI assistance subject to the enabled configuration.

BrightGate validates model connectivity and representative tasks during the demonstration. For a private or isolated deployment, confirm every AI dependency. Risk acceptance, control sign-off and other accountable decisions remain with authorised people.

10

Identity, infrastructure & integration

Fit the platform into the organisation’s identity and operating environment.

Explore features and implementation

Catalogue features
Identity-provider groups; infrastructure configuration management; outgoing webhooks; audit-log forwarding.

BrightGate scopes group-to-role mapping, approved endpoints and logging destinations. Each integration needs a defined payload, owner and failure-handling process; support for webhooks does not imply a ready-made connector to every product.

11

Configuration & experience

Make terminology and working views fit the people using the programme.

Explore features and implementation

Catalogue features
Terminology settings; custom portals; custom fields; focus mode.

BrightGate helps choose consistent English and Arabic terminology, necessary fields and relevant views. Validate changes with risk owners, assessors and managers so the configured experience supports everyday work without unnecessary complexity.

12Experimental · evaluation only

Experimental

The vendor’s twelfth catalogue area is explicitly marked experimental.

Explore features and implementation

Catalogue features
Exploratory functions only; the public catalogue does not enumerate approved production features for this area.

BrightGate keeps this area outside the committed production scope. Any evaluation needs a separate, controlled use case and a review of readiness before it can be considered for operational use.

Explore the capabilities alongside the decisions that turn a platform into a working service.

Scope and access

Organise assessments by entity, service, process or system. Domain-scoped permissions help separate responsibilities; this logical scoping should not be confused with separate databases for each tenant.

Libraries and repeatable work

Reusable libraries support framework and risk-matrix configuration. One-off and recurring tasks help keep evidence collection and review activities moving.

Management reporting

Configurable dashboards and metrics support oversight of progress and open work. Agree reporting definitions and evidence quality before treating a score as a management indicator.

Identity and operating controls

The vendor describes MFA and SSO support when configured. BrightGate’s design review covers role boundaries, identity dependencies, backup ownership and the process for updates.

RISK / FROM SCENARIO TO DECISION

Risk management needs more than a colour on a matrix. BrightGate helps define how your team identifies, assesses, treats and revisits a risk, using the supported methods and records in the agreed SHAHIN configuration.

01
Define the scenario
Identify the business service, asset, threat, consequence and risk owner. Agree the approved likelihood and impact scales before comparing scores.
02
Assess exposure
Distinguish inherent exposure, current exposure with operating controls, and residual exposure expected after treatment where enabled. Record the assumptions and evidence behind the assessment.
03
Plan treatment
Agree the treatment decision and link it to responsible owners, supporting controls and due dates. Prioritise work against the organisation’s risk appetite and business dependencies.
04
Review and accept
Route acceptance to the authorised decision-maker and record the basis for the decision. Agree when it must be reviewed; an acceptance record is not a legally binding electronic signature.
05
Monitor and reassess
Use scheduled reviews and relevant change events to revisit the assessment. BrightGate helps define the escalation route when a risk exceeds an agreed threshold.
06
Explore advanced methods
The vendor describes EBIOS RM workshops and Monte Carlo loss studies. Validate scope, input quality and interpretation with your risk specialists; the product is not presented as a certified FAIR implementation.

MEASUREMENT / KPIs & KRIs

A KPI tracks delivery or effectiveness; a KRI signals exposure that may need attention. SHAHIN supports configurable measurement. These are examples BrightGate can scope with your team, subject to the available records and validated configuration.

KPI

Control implementation

Implemented applicable controls ÷ applicable controls × 100. Define the status rules and assessment date; show unassessed items separately.

KPI

Evidence readiness

Controls with current, reviewed evidence ÷ controls requiring evidence × 100. Agree freshness and approval criteria.

KRI

Remediation overdue

Count open actions past their approved due date. Segment by severity, owner and age to focus follow-up.

KRI

Risk above appetite

Count assessed risks exceeding the approved threshold. Separate current and residual exposure rather than mixing them.

KPI

Critical supplier coverage

Critical suppliers assessed within the review period ÷ in-scope critical suppliers × 100. Define supplier criticality first.

KRI

High-severity findings

Count unresolved high-severity findings and show their age. Agree the severity model and closure evidence.

For every indicator, agree the owner, denominator, exclusions, refresh frequency, target and escalation threshold. Show an unavailable or zero-denominator measure as not assessed—not as 100% compliant.

SAUDI COMPLIANCE / NCA ECC

NCA Essential Cybersecurity Controls (ECC) is a regulatory control framework, while KPIs are measurements and third-party risk is a business area. The vendor lists an ECC 2:2024 library. BrightGate helps you apply the relevant requirements through the compliance and assurance workflow.

01
Confirm applicability
Record the entity, services and systems in scope, together with the official source and version. Document why a requirement is included or excluded.
02
Connect requirements to controls
Map applicable ECC requirements to your control register and assign ownership. Review mappings before reusing an assessment across another framework.
03
Assess and collect evidence
Record implementation status, evidence date and the reviewer’s conclusion. Evaluate control design and operation separately where required.
04
Close gaps and report
Give each gap an owner and a treatment plan. Report open work and reviewed evidence with the assessment result, so management can understand its basis.

Also listed by the vendor: NCA OTCC 1:2022, SAMA CSF v1.0, SAMA Cyber Resilience Fundamental Requirements v1.0 and the Saudi PDPL library. Confirm the official source, edition and applicability at activation. CCC, DCC and other roadmap packs must be verified separately. Software results do not constitute certification or regulatory endorsement.

48-SECOND OVERVIEW

A silent, captioned explainer. Motion graphics illustrate the workflow; they are not a recording of the product interface. Arabic and English captions are available.

Download MP4 ↓

Read the video transcript

00–08s SHAHIN AI connects governance, risk and compliance. Follow a requirement through controls and evidence to a reviewable decision.
08–16s Organise governance, risks, compliance, audit, third-party and privacy work. Define the scope, owner and next action.
16–24s Link requirements, control owners and supporting evidence. Review findings and track remediation with accountable follow-up.
24–32s Work in English and Arabic, including native right-to-left presentation. Validate terminology and user journeys during implementation.
32–40s Discuss on-premises, cloud, hybrid and SaaS requirements. Self-hosted and private environments are vendor-described; other arrangements need technical and commercial confirmation.
40–48s BrightGate helps scope, configure, validate and adopt the solution. Request a focused demonstration at info@brightgate.com.sa.

BUILT FOR YOUR TEAM

SHAHIN AI supports an English and Arabic experience, including right-to-left Arabic presentation. During implementation, BrightGate validates bilingual terminology, user journeys and representative reports with the people who will use the system.

English · LTRArabic · right-to-left

ARCHITECTURE & OPERATING MODEL

Discuss on-premises, cloud, hybrid and SaaS operating models with BrightGate. The vendor publicly describes self-hosted and private environments, including internet-isolated deployments. Cloud hosting architecture, hybrid boundaries and any managed SaaS service require a confirmed technical and commercial scope.

On-premises

Vendor-described self-hosting

A customer-managed environment can keep platform operations within your infrastructure. Confirm sizing, identity, backup, patching and AI connectivity; isolation must include every dependency.

Cloud

Private hosting design

Evaluate an agreed private cloud environment, region and access model. Confirm infrastructure responsibility, recovery objectives and where each data flow is processed.

Hybrid

Requires architecture validation

Define which components, data and integrations remain on site and which use cloud services. Confirm supported connectivity, trust boundaries and operation during link failures.

SaaS

Confirm managed-service availability

If a subscription service is preferred, confirm the vendor’s offer, tenant model, data location, service levels, export options and exit arrangements before committing.

Discuss hosting and integration requirements ↗

BRIGHTGATE / SAUDI ARABIA

01
Discover
Agree the legal entities, priority workflows, data boundaries, stakeholders and acceptance criteria.
02
Configure
Establish the scoped environment, access roles, initial registers, libraries and agreed integrations.
03
Validate
Walk through a requirement, assessment, evidence request, finding and remediation with the intended users.
04
Enable
Train administrators and owners; hand over design decisions, operating guidance and a prioritised improvement plan.

Make the demonstration relevant.

Bring one priority framework, a sample risk or control register, and a description of your current evidence process. We can structure a demonstration around the questions your team needs to answer.

Plan your demo ↗

EXPLORE WITH CONFIDENCE

SHAHIN AI brochure (PDF) ↓Download guide (PDF) ↓

What is a GRC solution?

GRC stands for governance, risk and compliance. A GRC system connects responsibilities, risks, obligations, controls and evidence so teams can assess their position and follow up on gaps.

How is GRC different from SOC?

GRC organises governance, assessment and evidence. A SOC focuses on security monitoring, investigation and response. SHAHIN includes distinct GRC and SOC paths; any integration and operational service are scoped separately.

Can BrightGate help with implementation and migration?

Yes. BrightGate can scope configuration, data preparation, agreed integrations, user validation and administrator handover. Existing spreadsheets and registers should be reviewed for ownership, quality and mapping before migration.

Does the software guarantee compliance?

No. The platform supports compliance operations. Results depend on applicability decisions, implementation, evidence and review; certification or regulatory approval cannot be inferred from a software score.

Product references

SHAHIN AI ↗ · Platform & access model ↗ · Saudi content libraries ↗ · Official 12-area GRC catalogue ↗ · Risk methods ↗

Reviewed 5 October 2026. Capabilities depend on the selected release, edition and configuration. Deployment, integrations, licences and support are confirmed in the proposal.

BEFORE YOU CHOOSE

SHAHIN AI / GRC

GRC Evaluation Checklist for Saudi Organisations

A useful GRC demonstration should connect a real risk to its controls, evidence, accountable owner and management report. Use this checklist to turn a broad software comparison into a practical evaluation.

Open the evaluation checklist ↗

NexusLearn / LMS

LMS Selection Checklist for Saudi HR & L&D Teams

Choose a learning management system around the work your people need to do. This practical checklist helps HR and learning teams compare onboarding, skills development and compliance training before committing to a platform.

Open the evaluation checklist ↗

All customer resources ↗

START WITH BRIGHTGATE

Request a demo ↗info@brightgate.com.sa