Advisory — Cybersecurity consulting for Gulf enterprises

Cyber risk assessment, threat intelligence, governance and compliance, security strategy, and AI security advisory for organisations across the Gulf.

Cyber Risk Assessment

Understanding what you are actually exposed to. Mapping real attack surface, identifying gaps, and prioritising by business impact with FAIR quantification. Not a checkbox exercise.

Threat Intelligence Advisory

Turning data into decisions. Tracking threat actors, attributing activity against MITRE ATT&CK and the Diamond Model, and building intelligence programs that inform action, not just generate reports.

Governance, Risk & Compliance

Framework alignment that works in practice, not just in documentation. Audit readiness and gap analysis across ISO 27001, PCI DSS, SOC 2, NIST CSF, SAMA CSF, NCA ECC and NESA, with evidence and remediation tracking.

Security Strategy & Architecture Review

From incident readiness to zero trust adoption, building security programs that fit the organisation, not the other way around.

AI Security & Trust Advisory

Helping organisations understand AI risk at the human layer, where a confident, fluent recommendation gets trusted without verification and the human gate itself can be compromised.

Security Awareness, via Excera

Personal, voice-first threat briefings in Arabic and English, tailored to each employee's role and exposure, aligned to GCC compliance frameworks. Delivered through Excera.

How I work

Discovery, then assessment against real threats and relevant frameworks, then clear prioritised strategy tied to business outcomes, then ongoing advisory for the decisions that come after the engagement. Clients include Gulf enterprises, government entities, financial institutions, and startups scaling security, across the UAE, Saudi Arabia, Qatar, Kuwait, Bahrain, Oman, and Egypt.

Book a security briefing.

Mahmoud Lotfy

Cybersecurity Consultant & Independent Security Researcher, Cairo

About Mahmoud Lotfy

Mahmoud Lotfy is a cybersecurity consultant and independent security researcher based in Cairo, Egypt. He works with organisations across the Gulf Cooperation Council region on cyber risk assessment, threat intelligence, governance, and security strategy.

Mahmoud began his career as a SOC analyst at one of the UK's largest broadband providers, where he spent two years on the frontline of security operations, developing expertise in security monitoring, alert triage, and threat detection. He then moved into consulting at SecurityHQ, working across more than seven clients simultaneously on incident response, forensic analysis, threat modelling, and governance frameworks.

He is building Excera, a research project into human risk intelligence for the agentic enterprise. Excera is a working prototype that generates a personal, voice-first threat briefing in Arabic and English for every employee, scoped to what they can authorise: moving money, granting access, approving AI agent actions.

Mahmoud hosts Tencast, an Arabic-language podcast featuring founders and operators across the Gulf in long-form conversations about building businesses in the region.

He holds a BSc (Honours) in Cybersecurity from Northumbria University, where his dissertation examined spear phishing vulnerability and the effectiveness of live attack demonstrations as a training intervention.

Recent Writing

We keep asking the wrong question about AI. AI doesn't have to be correct to be persuasive. Every AI failure reaches the same moment: a person looks at an output, accepts it as credible, and acts on it.
What most organisations get wrong about threat intelligence. Most companies treat threat intelligence as a feed they subscribe to and forget about. The real value comes from understanding how threats specifically apply to your environment.
Why your biggest security risk is probably someone you trust. 83% of organisations reported at least one insider attack in the last year. The breach that actually hurts tends to start much closer to home.
Why the human layer is the hardest security problem to solve. Most security budgets invest heavily in technical controls. The human layer sits near the bottom of the list. That's the wrong order of priorities.
The Gulf has mandated cybersecurity awareness training. Nobody told the training to speak Arabic. Every enterprise in the GCC is now legally required to train its people on cybersecurity. The platforms doing that training were built for someone else entirely.

Contact

Email: mahmoud@excera.live

LinkedIn: linkedin.com/in/mahmoud-lotfy