Saudi Arabia LCGPA and SITE sign agreement to localise cybersecurity technology production (Rakeen NGFW/IPS/XDR) for government entities

Mechanism

LCGPA — the same authority running the Localization of Industry & Knowledge Transfer (LIKT) mechanism and Mandatory List seen in its polymer street-lighting-pole (2025-12-01) and December 2025 batch-expansion (2025-12-09) filings — extends the localization playbook from physical industrial goods into digital/cybersecurity technology. SITE, a Public Investment Fund (PIF) portfolio company, stood up a dedicated subsidiary (Rakeen Cybersecurity) to domesticate production of network-security hardware/software (next-gen firewalls, IPS, XDR) that Saudi government entities previously had to source from foreign vendors. "Phase One" commits more than 15 government entities to adopt Rakeen products, with the explicit policy framing of building sovereign cybersecurity-technology capacity alongside the National Cybersecurity Authority.

Severity is set low (2): this is a single-vendor, single-subsidiary localization commitment with no disclosed contract value, procurement volume, or binding Mandatory List addition (unlike the December 2025 Mandatory List batch, which bound ~1,444 products). It is nonetheless a concrete industrial-policy action — a signed agreement with named government entities and technology product lines, not a mere announcement of intent.

Downstream implications

• Establishes a domestic-sourcing default for firewall/IPS/XDR technology

across at least 15 Saudi government entities, narrowing the addressable market for foreign cybersecurity vendors (Palo Alto Networks, Fortinet, CrowdStrike, etc.) in Saudi public-sector procurement going forward.

• Extends the LCGPA localization/Mandatory-List pattern (previously seen in

physical/industrial goods) into digital/ICT infrastructure — worth tracking alongside the broader digital-sovereignty theme as a potential precedent for further government-technology localization mandates.

• Ties cybersecurity-technology sovereignty to the PIF's portfolio-company

strategy (SITE), reinforcing PIF's role as the vehicle for Vision 2030 import-substitution across both physical and digital sectors.

Open questions

• No contract value, procurement volume, or multi-year commitment figure

disclosed for the SITE/Rakeen agreement — watch for follow-up disclosures.

• Whether Rakeen NGFW/IPS/XDR products are later added to LCGPA's binding

Mandatory List (which would meaningfully raise severity) has not yet been announced.

• Scope of "Phase Two" (if any) and whether the >15 entity list is public.