Power Across Security, Intelligence and the Cybersecurity Economy — and Who Oversees the Intersection of the Regulator, the Company and Family Interests?
This investigation does not begin with the question: “Is there an article accusing Musaed bin Mohammed Al-Aiban of corruption?” That is a limited question and reveals almost nothing about how power and money operate.
The broader question is: What powers have accumulated around Musaed Al-Aiban over more than three decades? What decisions and commercial entities fall within the circles he oversees? Who receives the contracts and investments? Where does the money move? What happens when the same man becomes chairman of the regulator and chairman of a government-owned commercial company operating in the sector it regulates? And what happens when companies led by his brother enter projects worth billions of riyals with companies owned by the Public Investment Fund?
We do not assume in advance that a crime exists. But we also do not assume in advance that all of these intersections are sound. The explanation is the responsibility of the decision-makers and the relevant entities, not the responsibility of this investigation on their behalf.
1. Who Is Musaed Al-Aiban in Practice?
The official biography alone reveals an exceptional degree of continuity at the center of the Saudi state.
Musaed bin Mohammed Al-Aiban has been Minister of State and a Member of the Council of Ministers since 2 August 1995. He has been a member of the Council of Political and Security Affairs and the Council of Economic and Development Affairs since their establishment in January 2015, Chairman of the Board of the National Cybersecurity Authority since its establishment in October 2017, and National Security Adviser since 27 December 2018. (Saudipedia: https://saudipedia.com/en/musaed-al-aiban)
Before that, he was a professor of international law and head of the law department at King Saud University, then an adviser at the Ministry of Petroleum and Mineral Resources and an adviser at the Royal Court. His father, Mohammed bin Abdullah Al-Aiban, was, according to Saudipedia, the first head of the Saudi intelligence service. (Saudipedia: https://saudipedia.com/en/musaed-al-aiban)
Even the oil sector appears in his early history. In October 2001, when Saudi Aramco’s board was reconstituted, Arab News reported that Musaed Al-Aiban was one of four members who left the board, establishing that he had served on the Aramco board before that date. (Arab News: https://www.arabnews.com/archive/215634)
We are therefore not talking about an official who appeared with the rise of Mohammed bin Salman.
We are looking at a man who remained within governing circles from the era of King Fahd, through King Abdullah, to King Salman and Mohammed bin Salman.
His institutional reach extends across:
Council of Ministers → politics and security → economy and development → national security → cybersecurity → sensitive international relations.
In 2023, for example, he led the Saudi delegation that negotiated in Beijing the resumption of Saudi-Iranian relations, then chaired in Jeddah a meeting of national security advisers and representatives from more than forty countries and organizations concerning the war in Ukraine. (Washington Post: https://www.washingtonpost.com/world/2023/03/10/saudi-iran-diplomatic-ties-restored/)
These are not indications of corruption.
But they define the scale of power that its holder should be subjected to scrutiny.
2. October 2018: Khashoggi’s Killing, Then the Rebuilding of Intelligence
After Jamal Khashoggi was killed inside the Saudi consulate in Istanbul, Royal Order No. 7422 was issued on 19 October 2018 establishing a ministerial committee to restructure the General Intelligence Presidency.
The committee was chaired by Mohammed bin Salman, and Musaed Al-Aiban was a member alongside the Interior Minister, Ibrahim Al-Assaf, the Chief of the Royal Court, the Foreign Minister, the President of General Intelligence and the President of State Security. (Saudi Press Agency: https://www.spa.gov.sa/w808606)
The committee’s task was not ceremonial.
The official text says it was charged with updating the intelligence system and regulations, defining powers, evaluating procedures, methods and authorities governing the work, and examining the administrative and hierarchical chain and the assignment of responsibilities. (Saudi Press Agency: https://www.spa.gov.sa/w808606)
At its first meeting, the committee identified gaps in:
the organizational structure,
legal frameworks,
policies, procedures and governance,
recruitment and qualification.
(Al Riyadh: https://www.alriyadh.com/1713455)
More sensitive recommendations followed.
A legal affairs department was established to review intelligence operations in relation to laws, international conventions and human rights; an internal performance evaluation and review department was established to verify compliance with approved procedures; a strategy and development department was established; and the intelligence activity committee and a mechanism for initial review and selection of personnel for missions were activated. (Okaz: https://www.okaz.com.sa/local/na/1693837)
These official documents create questions that the public statements did not answer:
What operations exposed the gaps?
Who was responsible for those gaps?
What exactly did the committee conclude regarding the chain of command?
What were Musaed Al-Aiban’s personal recommendations?
Were officials referred to administrative or criminal investigations as a result of the committee’s work?
Where is the committee’s full report and the minutes of its meetings?
The timing is notable:
19 October 2018: the intelligence restructuring committee was formed.
Around 20 December 2018: urgent solutions were announced.
27 December 2018: Musaed Al-Aiban was appointed National Security Adviser.
(Euronews: https://www.euronews.com/2018/12/27/saudi-king-appoints-new-foreign-minister-in-major-cabinet-reshuffle)
The chronology is established. The reason for the appointment, or its relationship to the committee’s findings, should not be invented; that is a direct question for Al-Aiban and the Royal Court.
3. What Happened After the Restructuring?
Here a significant accountability gap appears.
Research into Saad Aljabri’s cases, spyware files and the targeting of dissidents, and human-rights cases has not so far produced a reliable document establishing that Musaed Al-Aiban personally ordered the torture of Loujain al-Hathloul, the detention of a specific activist, the use of Pegasus, or the killing of Khashoggi.
But that does not end the question.
Al-Aiban formally participated in the committee tasked with correcting the intelligence system itself and then became National Security Adviser.
The legitimate question is therefore not to attribute to him an operation for which we do not possess evidence, but:
What did the committee fix?
What safeguards were created?
Who became responsible for approving sensitive operations?
How is the legality of operations reviewed?
Does the new legal department have the authority to stop an operation?
Is there independent review?
What happens when a security body violates those rules?
These are not merely historical questions. They test the outcome of the reform in which Al-Aiban participated.
4. The Move Into Cybersecurity
In October 2017, the National Cybersecurity Authority (NCA) was established.
Musaed Al-Aiban became the first Chairman of its Board and continues to chair it. (NCA: https://nca.gov.sa/en/board-of-directors/)
The Authority is not a small advisory center.
It is the national reference for cybersecurity and works to protect the state’s vital interests, national security, sensitive infrastructure, priority sectors and government services. (NCA: https://nca.gov.sa/ar/)
It also sets:
policies,
frameworks,
standards,
controls,
licensing,
and sector requirements.
Here begins the most important knot in this investigation.
5. Al-Aiban Chairs the Regulator… and SITE as Well
There is another company:
Saudi Information Technology Company — SITE.
It is owned by the Public Investment Fund.
In October 2025, the Saudi Press Agency explicitly identified:
Chairman of the Board of Directors of SITE Dr. Musaad Alaiban.
(Saudi Press Agency: https://www.spa.gov.sa/N2431784)
We also have older evidence placing him in SITE’s chairmanship earlier in the company’s history.
The structure therefore becomes:
Musaed Al-Aiban
↙ Chairman — NCA
↘ Chairman — SITE
But NCA is the regulator of the market in which SITE operates.
This is not a remote inference.
NCA itself states that all entities providing cybersecurity services, solutions or products must register, and it licenses Managed Security Operations Center services. (NCA: https://nca.gov.sa/ar/registration-and-licensing/)
NCA granted SITE a:
Managed SOC — Tier 1
license allowing it to serve government entities, the private sector and critical infrastructure.
SITE is not alone; the list also includes sirar, Haboob, Cyberani, TCC and Advanced Electronics. (NCA: https://nca.gov.sa/ar/registration-and-licensing/)
There is therefore no basis to say that SITE monopolizes the market.
But the other question does not disappear:
How is a situation managed in which the chairman of the regulator is simultaneously chairman of one of the commercial companies regulated by that authority?
6. The Relationship Is Deeper Than “A Licensed Company”
NCA itself used an extremely important description.
In its report on securing Saudi Arabia’s G20 Presidency, it described SITE as:
NCA’s operational arm
(NCA G20 Report: https://nca.gov.sa/G20Report.pdf)
SITE was responsible within the G20 program for:
24/7 cybersecurity monitoring,
situational awareness,
risk and threat analysis,
sharing threat reports,
incident-management support,
risk assessments,
penetration testing,
vulnerability assessments,
compromise assessments,
compliance assessments.
(NCA G20 Report: https://nca.gov.sa/G20Report.pdf)
The relationship continues.
In 2026, NCA said that its cybersecurity exercise program, involving more than 1,800 specialists from more than 300 national entities, uses a specialized platform developed, hosted and operated locally in cooperation with the Authority’s “technical arm,” SITE. (NCA: https://nca.gov.sa/en/news/during-h1-2026the-national-cybersecurity-academy-delivers-specialized-training-programs-to-enhance-national-cyber-readiness/)
SITE also implements accelerator programs for startups with NCA. (NCA: https://nca.gov.sa/en/news/nca-launches-the-third-cohort-of-the-cybersecurity-accelerator-with-seven-local-startups/)
SITE is therefore not merely a vendor selling a firewall to a ministry.
It is an operational and technical part of the national model itself.
7. Haseen and Sensitive Data
NCA operates the Haseen ecosystem, which allows national entities, among its services, to upload and review their technical assets, connect them with national services and manage risk information, among other functions. (NCA: https://nca.gov.sa/ar/services/risk-assessment-management/)
Because SITE works as a technical and operational arm in parts of the national ecosystem, it becomes necessary to disclose:
Who hosts each component?
Who owns the encryption keys?
Who has privileged administrator access?
Can SITE employees access entity data?
What are the logging controls?
Who is the data controller and who is the processor?
What is the list of subcontractors?
These questions do not assume that SITE reads classified data.
They ask who can technically access it and who monitors that access.
8. We Began Following the Money: Ministry of Finance
The first contract extracted from official records was:
Information Security Strategy Project — Ministry of Finance.
Value:
SAR 5,747,982
Executor:
SITE
Duration:
9 months.
We then found another 2019 contract involving a security test of the Ministry of Finance data-center network, the connection with the Saudi Arabian Monetary Authority, and testing of a ministry application:
SAR 856,800
Implementation period:
8 weeks.
The verified minimum extracted from the Ministry of Finance alone therefore becomes:
SAR 6,604,782
This is not the total amount the government has paid SITE.
It is only the portion we were able to establish from this set of records.
9. Three Ministry of Foreign Affairs Contracts
In October 2024, the Saudi Ministry of Foreign Affairs signed three cybersecurity contracts with SITE.
Names appearing around the signing included:
Safar Al-Mamoun — Ministry of Foreign Affairs
Wael Fattouh — SITE
and in the presence of:
Saad Alaboodi — CEO SITE
and:
Majed Al-Mazyed — Governor NCA.
The total value and method of competition did not appear in the public announcement we found.
What is required:
contract numbers,
value of each contract,
implementation period,
competitors,
award method,
and who approved them.
10. Public Prosecution
Cooperation also appeared between SITE and the Public Prosecution in areas including cybersecurity, digital and cloud solutions, data and modern technologies.
Here the question becomes more sensitive than price alone:
Does SITE access criminal-case data?
Does it host systems?
Does it have privileged access?
Who owns the encryption keys?
We do not have evidence allowing us to say that SITE views case files.
But the nature of the relationship makes this a question that the Public Prosecution and SITE should answer.
11. Alibaba/STC: A Company With SAR 894 Million in Capital
In May 2022, the General Cloud Computing Company for Information Technology was established with capital of:
SAR 894 million
Ownership:
STC — 55%
eWTP Arabia — 27%
Alibaba Cloud — 10%
SCAI — 4%
SITE — 4%.
(Saudi Exchange: https://www.saudiexchange.sa/Resources/fsPdf/480_0_2023-03-23_12-17-51_En.pdf)
STC’s disclosure identifies PIF as a related party because of its ownership and relationships with the participating companies, and says the agreement was concluded in the ordinary course of business without preferential advantages. (Saudi Exchange: https://www.saudiexchange.sa/Resources/mfpdfs/stmt/325_1_2023-03-30_15-49-20_En.pdf)
SITE’s mathematical share of the capital, if contributions were fully proportional:
SAR 35.76 million.
But this is a figure inferred from the ownership percentage, not independent proof of the amount of cash SITE actually paid.
12. AhnLab: More Than SAR 500 Million
In March 2024, PIF announced an agreement between SITE and South Korea’s AhnLab.
The official announcement states:
SAR 500+ million dual investment
to develop and localize cybersecurity technologies in Saudi Arabia and the region. (PIF: https://www.pif.gov.sa/ar/news-and-insights/newswire/2024/site-and-south-koreas-ahnlab-join-forces-to-advance-cybersecurity-tech-in-mena/)
It includes:
SITE Ventures acquiring 10% of AhnLab through a capital increase,
the establishment of a JV,
and a research-and-development program.
We then went to Korea because AhnLab is publicly listed, and the numbers that were not disclosed in the Saudi statements began to appear.
13. KRW 74.425 Billion
SITE Ventures subscribed to AhnLab’s capital increase.
AhnLab’s 2024 cash-flow statement shows:
KRW 74,425,225,390
from the issuance of shares. (Financial Filings: https://financialfilings.com/filings/ahnlabinc/annual-report/2025/7925707/)
At the end of 2024, SITE Ventures owned:
1,112,651 shares
or:
10.00% of AhnLab.
(Financial Filings: https://financialfilings.com/filings/ahnlabinc/annual-report/2025/7925707/)
This was approximately around SAR 200 million at the exchange rate in the period, with the precise exchange rate to be used in the final financial version.
Saudi Arabia also obtained board representation at AhnLab.
Hassan M. AlHussain became a non-executive director of AhnLab beginning in September 2024; the disclosures identify him as Managing Director of SITE Ventures and CFO at SITE. (Financial Filings: https://financialfilings.com/filings/ahnlabinc/interim-quarterly-report/2025/7904639/)
14. Rakeen
The company resulting from the JV is:
Digital Fortification for Information Technology Company — Rakeen.
Ownership structure:
SITE — 75%
AhnLab — 25%.
AhnLab said the company would combine its technical expertise with SITE’s ability in the Saudi market and localization, offering endpoint/network/XDR products before expanding into other areas. (AhnLab: https://blog.ahnlab.com/2797?category=763641)
But when we examined the capital, a surprise appeared.
15. AhnLab’s Contribution to Rakeen Capital: Only KRW 48.47 Million
The Korean 2025 financial statements show that AhnLab paid:
KRW 48.47 million
for its 25% stake in Rakeen. (Korea Exchange filing: https://kind.krx.co.kr/external/2025/05/14/000235/20250514000464/11013.htm)
If capital contributions were proportional at 75/25, that would suggest approximately:
AhnLab: KRW 48.47m
SITE: KRW 145.41m
Total: KRW 193.88m.
This is a mathematical inference that should not become a final fact before obtaining the Saudi company registry.
But it establishes something more important:
The SAR500m+ package cannot simply be treated as Rakeen’s capital.
16. So Where Is the Rest of the SAR 500+ Million?
We know approximately that around SAR 200 million is associated with the subscription for 10% of AhnLab.
Rakeen’s visible initial capital, by contrast, is very small relative to the package.
A large part of the announced figure therefore still requires a breakdown:
technology localization,
R&D,
future commitments,
infrastructure,
product development,
or other components.
PIF and SITE should therefore be asked:
How much of the SAR500m+ was committed?
How much was actually deployed?
How much went to AhnLab?
How much went to Rakeen?
How much remained a future commitment?
The unexplained portion is not “missing money”; it is money for which we have not yet found a public disclosure breaking down its destination.
17. Then Something Notable Happened in the Accounting
In the first half of 2025, AhnLab’s statements showed:
Investment in Rakeen: KRW48.47m
then:
equity-method loss: KRW48.47m
then the carrying value became:
ZERO.
(Financial Filings: https://financialfilings.com/filings/ahnlabinc/interim-quarterly-report/2025/7874711/)
The annual statements also show:
KRW48.47m equity-method loss.
(Korea Exchange filing: https://kind.krx.co.kr/external/2026/03/13/000466/20260313001454/00591.htm)
This does not mean Rakeen went bankrupt.
It means the book value of that investment at AhnLab was consumed in accounting terms by the recognized losses.
18. At the Same Time, AhnLab Generates Sales From Rakeen
Here a more important economic story begins.
AhnLab’s statements show related-party receivables connected to Rakeen reaching:
KRW 13.26696 billion
in the relevant annual disclosure. (Korea Exchange filing: https://kind.krx.co.kr/external/2026/03/20/001105/20260320004164/11011.htm)
Then in February 2026, AhnLab announced that Rakeen products, including Rakeen NGFW and Rakeen IPS, achieved meaningful sales and contributed to growth in the Korean company’s international-revenue ratio. (AhnLab: https://blog.ahnlab.com/m/2947)
The economic question therefore becomes:
AhnLab owns 25% of Rakeen, but it is also a technical and commercial supplier to it.
AhnLab can therefore generate supplier revenue even during a period in which Rakeen itself is loss-making.
What is required:
transfer-pricing agreement
wholesale prices
royalties
licensing fees
technical-support fees
gross margin retained by Rakeen.
19. Then the Saudi Government Enters as a Customer
On 29 October 2025, SITE and the Local Content and Government Procurement Authority signed an agreement to launch:
Phase One of national adoption of localized cybersecurity technologies
The first phase will provide Rakeen products to:
more than 15 government entities.
(Saudi Press Agency: https://www.spa.gov.sa/N2431784)
The event was attended by:
Musaed Al-Aiban — Chairman SITE
Yasir Al-Rumayyan — Governor PIF
Bandar Alkhorayef — Chairman LCGPA
Majed Al-Mazyed — Governor NCA.
(Saudi Press Agency: https://www.spa.gov.sa/N2431784)
The value was not disclosed in the announcement.
The names of the 15+ entities were not disclosed.
Product prices were not disclosed.
The selection mechanism was not disclosed in the statement.
20. The Money Circle That Must Be Disclosed
We now have a path that can be investigated:
PIF
↓ owns SITE
SITE
↓ owns 75% of Rakeen
Saudi Government Entities
↓ purchase Rakeen products
Rakeen
↓ purchases/licenses technology from AhnLab
AhnLab Korea
At the same time:
SITE Ventures → 10% AhnLab.
The real question is therefore not merely “Did money leave for Korea?”
It is:
Of every 100 riyals the government pays for a Rakeen product, how much remains inside Saudi Arabia and how much goes to AhnLab or foreign suppliers?
And what is the:
Saudi local-content percentage?
21. The Regulator Appears on the Other Side of the Circle
NCA is chaired by Al-Aiban.
SITE is chaired by Al-Aiban.
SITE owns Rakeen.
Rakeen sells cybersecurity products.
NCA sets cybersecurity controls and manages registration/licensing for the market.
This is the core of the conflict-of-roles question in this investigation.
So far, we do not have minutes proving that Al-Aiban participated in a specific regulatory decision favoring Rakeen.
But we also did not find a public disclosure showing:
recusal,
conflict-of-interest protocol,
independent approval,
or board minutes explaining how the two roles were separated.
These documents should be requested.
22. There Are Competitors — But That Does Not Resolve the Question
NCA licenses a number of Tier-1 Managed SOC providers, not SITE alone. (NCA: https://nca.gov.sa/ar/registration-and-licensing/)
We also found NCA contracts won by other companies.
That prevents an unsupported claim that SITE receives all NCA business.
But it does not answer the different question:
What safeguards prevent the chairman of the regulator from influencing decisions affecting a company whose board he chairs?
23. SITE Ventures: The Source-of-Funds Question
Another question remains open.
Information presented in the context of the AhnLab transaction about SITE Ventures showed, in earlier data, a relatively small financial size and a negative equity position, yet in 2024 it was able to execute a cash investment equivalent to tens of billions of won.
The transaction disclosures treat the money used to acquire AhnLab as funds available to SITE Ventures, but that does not tell us how the money entered SITE Ventures before the purchase.
We therefore need:
2023 financial statements,
2024 financial statements,
capital increases,
shareholder contributions,
related-party funding,
transfers from SITE.
The question:
How much funding did SITE provide to SITE Ventures before the KRW74.4bn AhnLab transaction?
24. Rakeen Is Not Alone: METRAS
In October 2023, SITE and the American company Privafy established a joint venture:
METRAS.
The announced goal was to localize cybersecurity/XDR technologies.
Then:
SITE METRAS XDR
appeared as an actual product.
We therefore have a model:
foreign technology company
↓
JV with SITE
↓
localized Saudi cybersecurity product.
But we have not yet found a specific government contract allowing us to say that METRAS received a government-adoption program comparable to Rakeen.
We need:
SITE ownership,
Privafy ownership,
capital,
IP rights,
royalties,
government customers.
25. Sydr Systems
There is also:
Sydr Systems
linked to SITE’s partnership with NIL, operating in:
systems integration,
networks,
cloud,
cybersecurity.
Here too, transfers of expertise and personnel from NIL to Sydr appeared, making localization more than simply reselling software in some cases.
But the same information is required:
ownership → funding → government contracts → margins → foreign payments.
26. Fortanix
PIF’s 2023 report disclosed SITE’s cooperation with Fortanix to launch a data-security/SaaS solution with a dedicated node inside Saudi Arabia serving the region.
SITE’s model is therefore broader than one company:
Foreign technology
↓
SITE partnership/JV
↓
Saudi-hosted/localized product
↓
Saudi/MENA market.
This is a complete business and industrial strategy.
27. Microsoft Sovereign Cloud
In November 2025, PIF, SITE and Microsoft signed a memorandum to explore sovereign-cloud services in Saudi Arabia, including sensitive and regulated sectors.
If the memorandum turns into implementation, it is necessary to know:
Who owns the infrastructure?
Where is the data located?
Who manages the encryption keys?
Who has privileged access?
Who pays whom?
What are the minimum purchase commitments?
What is NCA’s role in approvals?
28. SITE Is Therefore Not a Small Company
The picture that emerged is:
PIF
↓
SITE
↓
SITE Ventures → 10% AhnLab
↓
Rakeen → SITE 75% / AhnLab 25%
↓
METRAS → JV with Privafy
↓
Sydr Systems → NIL partnership
↓
Alibaba/STC Cloud JV → SITE 4%
↓
Fortanix partnership
↓
Microsoft sovereign-cloud initiative
At the top of SITE:
Musaed Al-Aiban — Chairman.
At the top of the market regulator:
Musaed Al-Aiban — Chairman NCA.
This is not a “conviction.”
It is a map of power and money that requires disclosure.
29. Now We Move to the Family: Abdulelah Al-Aiban
The second part is entirely different.
Musaed Al-Aiban’s brother:
Abdulelah bin Mohammed Al-Aiban
is a businessman who leads Midad companies.
Reuters itself identified him, in its coverage of the Lukoil transaction, as the brother of National Security Adviser Musaed Al-Aiban. (Reuters: https://www.reuters.com/business/energy/saudi-firm-midad-among-frontrunners-buy-lukoils-global-assets-sources-say-2025-12-16/)
Here, Midad money should not be mixed with SITE or PIF money.
The question is different:
Did the brother’s companies receive transactions, assets or partnerships with the state/PIF? If so, how were they selected and on what terms?
30. Midad Real Estate and Jeddah Central
On 13 November 2025, Jeddah Central Development Company, owned by PIF, announced a JV partnership with Midad Real Estate to develop:
Atlantis
and:
One&Only
at Jeddah Central.
Signing for Midad was:
Abdulelah bin Mohammed Al Aiban.
(Jeddah Central: https://web2.jeddahcentral.com/en/news-and-media/news/midad)
Midad places the project value at:
SAR 7.6 billion.
(Midad: https://midad.com.sa/en/news/)
But the figure is the announced project/partnership value, not proof that PIF paid SAR 7.6 billion to Midad.
What should be extracted:
each party’s ownership percentage,
land value,
who contributed the land,
land valuation,
equity contributions,
debt financing,
guarantees,
development fees,
management fees,
residential-sale proceeds,
exit rights.
31. Then Diriyah: SAR 3.1 Billion
Less than two months later, on 7 January 2026, Diriyah Company announced a joint-development agreement with Midad to build:
Four Seasons Hotel and Private Residences Diriyah.
Value:
SAR 3.1 billion / $827 million
including land and construction.
The project covers approximately 235,938 square meters and includes a 159-room hotel in addition to branded private residences. (Diriyah Company: https://www.diriyahcompany.sa/en/news/diriyah-company-and-midad-development-and-real-estate-investment-company-announce-joint-development-agreement-for-four-seasons-hotel-and-private-residences-diriyah)
Thus, within a short period, announced projects between Midad and entities connected to the PIF ecosystem reached a combined project value of approximately:
SAR 10.7 billion
Again:
This is not an amount paid to the Al-Aiban family.
But its scale imposes the questions:
How was Midad selected?
Was there competition?
Who evaluated the proposal?
What is Midad’s contribution percentage?
Did it receive land? At what valuation?
Are there guarantees or government financing?
Did Musaed Al-Aiban disclose the family relationship?
Did he participate in any government or PIF decision affecting these projects?
Did he recuse himself?
32. Midad Is Not a Company That Appeared Yesterday
Midad Real Estate’s stated history shows projects years older than these transactions.
It would therefore be incorrect to construct a theory that the company was suddenly created to obtain Vision 2030 projects.
But the question that remains valid is:
How did the scale of its business change before and after entering partnerships with PIF entities?
This can be measured if we obtain:
revenues,
assets,
equity,
project pipeline,
debt,
from 2005 to 2026.
33. Midad Energy: Algeria
In October 2025, Midad Energy North Africa signed a production-sharing contract with Algeria’s Sonatrach to develop Illizi South.
Expected investment value:
$5.4 billion
Contract duration:
30 years
with a possible ten-year extension.
Most importantly:
Sonatrach officially states that:
Midad Energy North Africa will bear 100% of the financing
including:
$288 million for the research/exploration phase.
(Sonatrach: https://sonatrach.com/en/sonatrach-midad-energy-north-africa-sign-hydrocarbon-contract-in-the-perimeter-of-illizi-south/)
In March 2026, an Algerian presidential decree formally approved the contract. (Algerian Official Journal: https://www.joradp.dz/FTP/jo-francais/2026/F2026020.pdf)
These are enormous figures for a private company with limited public financial disclosure.
The question:
Where does the $5.4bn come from?
Equity?
Syndicated loans?
Project finance?
Saudi banks?
International banks?
State guarantees?
Co-investors?
Offtake financing?
Government money should not be assumed.
But a company undertaking to finance $5.4 billion should have a funding architecture that can be traced.
34. The Dutch Entity
The company used in the Algerian transaction is:
Midad Energy North Africa B.V.
registered in the Netherlands.
Open commercial records indicate:
KvK 92558992
and the address:
Kingsfordweg 151, Amsterdam
with incorporation in January 2024. (Compadex: https://www.compadex.com/nl/businesses/nl/midad-energy-north-africa-b-v-92558992-58154779)
Midad’s own website also lists the Dutch company’s address. (Midad Energy: https://www.midadenergy.com/contact-us)
Activity later appeared in Spain as well; the Spanish commercial registry published in June 2026 the appointment of:
Abdulelah Mohammed Abdullah Alaiban
as representative of the Spanish branch of Midad Energy North Africa B.V. (BOE/BORME: https://www.boe.es/borme/dias/2026/06/24/pdfs/BORME-A-2026-119-28.pdf)
What is now required from the complete Dutch registry:
ultimate shareholder,
directors,
capital history,
2024/2025 accounts,
related-party liabilities,
guarantees.
35. Then Lukoil: The Leap to $22 Billion
In December 2025, Reuters reported that Midad Energy had become one of the leading contenders for the international assets of Russia’s Lukoil, estimated at around:
$22 billion.
(Reuters: https://www.reuters.com/business/energy/saudi-firm-midad-among-frontrunners-buy-lukoils-global-assets-sources-say-2025-12-16/)
The assets include fields, refineries and fuel-station networks in multiple countries.
The matter is more sensitive because Lukoil is subject to U.S. sanctions.
Then in February 2026, Reuters reported that Midad had signed a term sheet to acquire the targeted assets and that its offer was:
all-cash
and placed in:
escrow
pending approvals, including approval by the U.S. Treasury. (Reuters: https://www.reuters.com/business/energy/saudi-backed-midad-signs-term-sheet-with-lukoil-sanctioned-assets-pending-2026-02-12/)
The financial question here becomes enormous:
A company undertakes to finance a $5.4bn Algerian project, then appears with a cash offer for an asset portfolio of around $22bn.
Where does the capital come from?
Who are the:
banks?
family offices?
sovereign investors?
co-investors?
debt arrangers?
escrow bank?
financial advisers?
36. The Political Timing Deserves a Question
Musaed Al-Aiban is Saudi Arabia’s National Security Adviser.
His brother leads Midad.
In February 2025, Musaed Al-Aiban participated in high-level Saudi security and diplomatic contacts/talks involving the United States and Russia.
Then, at the end of 2025 and beginning of 2026, his brother’s company became a contender for Russian assets subject to U.S. sanctions. Reuters itself noted the family relationship and context. (Reuters: https://www.reuters.com/business/energy/saudi-firm-midad-among-frontrunners-buy-lukoils-global-assets-sources-say-2025-12-16/)
We do not have a document establishing that Musaed Al-Aiban intervened on Midad’s behalf.
But the questions cannot be ignored:
Did Musaed Al-Aiban participate in any government discussion concerning Lukoil, sanctions or licensing of the transaction after Midad entered the bidding?
Did he disclose a family interest?
Did he recuse himself from related files?
Did the Saudi government ask Washington for anything related to the transaction?
Did the Saudi state provide a guarantee, financing or diplomatic support?
If the answer is “no,” Al-Aiban and the government can say so clearly.
37. A Historical Point That Should Not Be Ignored
Musaed Al-Aiban was, early in his career, an adviser at the Ministry of Petroleum and later a member of the Aramco board before leaving it in 2001. (Saudipedia: https://saudipedia.com/en/musaed-al-aiban)
Today, his brother leads an energy company entering multibillion-dollar transactions.
That alone proves nothing.
But it makes reconstructing the full history of the family’s relationships with the energy sector legitimate and necessary:
When were Midad companies established?
Who financed them?
Who were their owners?
Who entered and exited?
What were the predecessor companies?
What are their relationships with Saudi banks?
What was Abdulelah Al-Aiban’s history before Midad?
38. The Thread Connecting the Entire File
After digging, the investigation is no longer one story.
There are two large circles around Musaed Al-Aiban.
The first circle: direct authority.
National Security Adviser
↓
NCA Chairman
↓
SITE Chairman
↓
SITE Ventures
↓
AhnLab
↓
Rakeen
↓
15+ government entities.
Alongside it:
METRAS,
Sydr,
Alibaba Cloud JV,
Fortanix,
Microsoft sovereign cloud.
The second circle: a family relationship whose boundaries should be tested.
Musaed Al-Aiban
↕ brother
Abdulelah Al-Aiban
↓
Midad Real Estate
↓
Jeddah Central / PIF ecosystem
↓
SAR7.6bn project
Then:
Midad
↓
Diriyah
↓
SAR3.1bn project
In energy:
Midad Energy
↓
Sonatrach
↓
$5.4bn
Then:
Midad
↓
Lukoil bid
↓
≈$22bn asset portfolio.
39. Questions Musaed Al-Aiban Should Answer
1. Since exactly what date have you been Chairman of SITE?
2. Were you Chairman of SITE when you became Chairman of NCA?
3. What conflict-of-interest system separates your role as chairman of the regulator from your role as chairman of a commercial company in the same sector?
4. Did you recuse yourself from voting on any NCA decision relating to SITE?
5. Are there minutes proving that?
6. Did you participate in any decision relating to SITE’s Tier 1 Managed SOC license?
7. Did you participate in any NCA decision relating to Rakeen, METRAS or Sydr?
8. By virtue of chairing NCA, did you have access to commercial information unavailable to SITE’s competitors? What controls prevent its commercial use?
9. Who approved the AhnLab package exceeding SAR500m?
10. Did the SITE board vote on it? Did you vote?
11. What is the complete breakdown of the SAR500m+?
12. What is the source of the money SITE Ventures used to acquire 10% of AhnLab?
13. What was the value of funding provided by SITE or PIF to SITE Ventures in 2023–2024?
14. What is the total value of government contracts with SITE since its establishment?
15. What is the value of the Rakeen program for the 15+ entities?
16. What are the names of those entities?
17. Was there competition?
18. How much of every riyal paid for Rakeen products remains inside Saudi Arabia?
19. How much does Rakeen pay AhnLab in licensing/royalties/products/support?
20. Who owns the IP and source code?
21. Are Rakeen products included in any mandatory/preferred government-procurement mechanism?
22. Who has privileged access to national systems developed or hosted by SITE?
23. What exactly is SITE’s role in Haseen?
24. Can any SITE employee access cybersecurity-posture or asset information belonging to government entities?
25. Where are audit logs held and who reviews them?
26. What gaps did the Royal Order 7422 committee discover after Khashoggi’s killing?
27. What were your personal recommendations?
28. What responsibilities did the committee identify?
29. Is there a complete copy of the final report?
30. Was any official referred for investigation as a result of the committee’s findings?
31. What powers does the legal department created to review intelligence operations possess?
32. Can it stop an operation that violates law or human rights?
33. Did you disclose your brother’s commercial interests to the government or PIF?
34. Did you participate in any decision relating to Midad Real Estate or Midad Energy?
35. Did you recuse yourself from any file involving Jeddah Central, Diriyah, Sonatrach or Lukoil?
36. Did Midad or any company associated with your brother receive Saudi government financing or guarantees?
37. Did you discuss the Lukoil transaction with U.S., Russian or Saudi officials after Midad became a bidder?
38. Did any Saudi government entity provide political, financial or regulatory support for the transaction?
40. Questions for PIF and SITE
What we specifically require from them:
the complete financial statements of SITE and SITE Ventures;
all capital injections since establishment;
all government contracts and their values;
all subsidiaries/JVs and ownership percentages;
METRAS ownership;
Sydr ownership;
Rakeen shareholder agreement;
AhnLab investment approval;
board minutes relating to the SAR500m+;
conflict-of-interest policy;
recusal records relating to Musaed Al-Aiban;
value of the 15+ government deployment;
all royalties/licensing payments to AhnLab;
details of the Microsoft sovereign-cloud arrangement;
and details of the Alibaba/STC cloud investment.
41. Questions for NCA
What is required from NCA is not a general opinion about the integrity of the system.
Documents are required.
Who made the decision to license SITE as Tier 1?
Did the Chairman participate?
How are conflicts of interest managed?
Does SITE receive regulatory information unavailable to competitors?
Did SITE participate in drafting standards affecting its products?
What is NCA’s relationship to Rakeen qualification?
What is NCA’s relationship to METRAS?
What are the limits of SITE’s technical access to Haseen and national platforms?
Who monitors SITE when it acts as NCA’s operational/technical arm?
The final question may be the most important:
Who audits the regulator’s operational arm when the same person chairs both institutions?
42. Questions for Midad
In real estate:
How was Midad selected for Jeddah Central?
What is the ownership split?
What is the land value?
Who valued it?
What is Midad’s cash contribution?
What is the financing?
What are the guarantees?
What are the development fees?
What are the expected revenues from private residences?
And the same questions apply to the Diriyah project.
In energy:
Who will finance the $5.4bn Illizi South project?
Which banks?
What percentage is equity?
What is the debt?
What are the guarantees?
What is the collateral?
Who are the advisers?
Then Lukoil:
Who finances the all-cash bid?
Who is the escrow agent?
Is there PIF money?
Are Saudi state-owned banks involved?
Are there guarantees?
Is there sovereign support?
Did Midad communicate with Musaed Al-Aiban regarding the transaction?
43. What Has Become Established So Far?
We have Al-Aiban’s extended political and security authority since 1995. (Saudipedia: https://saudipedia.com/en/musaed-al-aiban)
We have his membership in the intelligence restructuring committee after Khashoggi, and a committee that acknowledged gaps in structure, law, governance and procedures. (Saudi Press Agency: https://www.spa.gov.sa/w808606)
We have his chairmanship of NCA. (NCA: https://nca.gov.sa/en/board-of-directors/)
And we have his chairmanship of SITE documented in the government announcement. (Saudi Press Agency: https://www.spa.gov.sa/N2431784)
We have SITE officially described as NCA’s operational/technical arm. (NCA G20 Report: https://nca.gov.sa/G20Report.pdf)
We have SITE’s NCA license as a Tier-1 MSOC provider alongside other competitors. (NCA: https://nca.gov.sa/ar/registration-and-licensing/)
We have the SITE/AhnLab investment announced at more than SAR500m. (PIF: https://www.pif.gov.sa/ar/news-and-insights/newswire/2024/site-and-south-koreas-ahnlab-join-forces-to-advance-cybersecurity-tech-in-mena/)
We have a Korean cash flow of KRW74.425bn from the share issuance that made SITE Ventures a 10% owner of AhnLab. (Financial Filings: https://financialfilings.com/filings/ahnlabinc/annual-report/2025/7925707/)
We have Rakeen at 75/25.
We have AhnLab’s KRW48.47m contribution to its capital. (Financial Filings: https://financialfilings.com/filings/ahnlabinc/interim-quarterly-report/2025/7904639/)
We have an equity-method loss approximately equal to AhnLab’s full contribution, bringing the carrying value to zero in the disclosure. (Financial Filings: https://financialfilings.com/filings/ahnlabinc/interim-quarterly-report/2025/7874711/)
We have a related-party receivable from Rakeen of KRW13.26696bn in the relevant disclosure. (Korea Exchange filing: https://kind.krx.co.kr/external/2026/03/20/001105/20260320004164/11011.htm)
We have AhnLab’s statement that sales of Rakeen products helped grow its international business. (AhnLab: https://blog.ahnlab.com/m/2947)
We have a Saudi government program to introduce Rakeen products into 15+ entities. (Saudi Press Agency: https://www.spa.gov.sa/N2431784)
We have a cloud company with SAR894m in capital in which SITE owns 4%. (Saudi Exchange: https://www.saudiexchange.sa/Resources/fsPdf/480_0_2023-03-23_12-17-51_En.pdf)
We have METRAS, Sydr and other technology partnerships.
We have Al-Aiban’s brother leading Midad.
We have the Jeddah Central project announced at SAR7.6bn. (Midad: https://midad.com.sa/en/news/)
We have the Diriyah project at SAR3.1bn. (Diriyah Company: https://www.diriyahcompany.sa/en/news/diriyah-company-and-midad-development-and-real-estate-investment-company-announce-joint-development-agreement-for-four-seasons-hotel-and-private-residences-diriyah)
We have the Sonatrach contract at $5.4bn, 100% financed by Midad Energy North Africa according to Sonatrach. (Sonatrach: https://sonatrach.com/en/sonatrach-midad-energy-north-africa-sign-hydrocarbon-contract-in-the-perimeter-of-illizi-south/)
We have Midad Energy North Africa B.V. in Amsterdam under KvK 92558992. (Compadex: https://www.compadex.com/nl/businesses/nl/midad-energy-north-africa-b-v-92558992-58154779)
We have Midad’s attempt to acquire Lukoil’s international assets estimated at around $22bn, followed by a term sheet and an all-cash offer in escrow subject to U.S. approvals. (Reuters: https://www.reuters.com/business/energy/saudi-firm-midad-among-frontrunners-buy-lukoils-global-assets-sources-say-2025-12-16/)
Investigative Conclusion
The issue that emerged from this digging is not a simple accusation that can be reduced to the word “corruption.”
It is a matter of concentration of power, governance, potential conflicts of roles, and transparency of public and private money when it intersects with the state.
Musaed Al-Aiban sits at a highly unusual point in the Saudi system:
He is a longstanding member of the Council of Ministers, a member of the political-security and economic-development councils, the National Security Adviser, participated in restructuring the intelligence service, and chairs the national authority regulating cybersecurity.
At the same time, he chairs SITE, the PIF-owned company operating commercially inside that same sector, which NCA describes as its technical and operational arm, which has built a network of investments, companies and foreign partnerships, and one of whose entities obtained a program to deploy its products across more than 15 government entities.
Then, in a separate circle that warrants examination, his brother leads the Midad group, which within a short period entered multibillion-riyal projects with companies connected to the PIF ecosystem, undertook to finance a $5.4 billion Algerian energy project, and then emerged as a cash bidder for Lukoil’s international asset portfolio estimated at around $22 billion.
The question that should remain open until the documents arrive is not: Are these relationships legal or illegal?
The question is:
Where are the institutional walls separating regulatory and security authority from commercial interests, and who can prove that they actually worked when these circles intersected?
Then the financial question:
Who paid? Who decided? Who received the money? What was the return? And who bore the losses and risks?
Then the personal question for Musaed Al-Aiban:
When decisions affected a company you chair, or a company owned or led by your brother, where is the document showing disclosure, recusal and independent review?
Those documents — not press releases and not assumptions — are what will determine the next stage of the investigation.
