As of this month, FABRIC MDR operates at full capability from the Riyadh watch floor. Every alert that crosses the fabric is triaged by our AI SOC analysts within seconds, and every escalated case is owned end to end by an operator sitting in the Kingdom.
Full operating capability is a specific claim, and we held ourselves to a specific bar before making it: continuous coverage with no gaps across shift boundaries, AI triage on one hundred percent of inbound alerts, containment authority pre-agreed with every enrolled client, and a measured mean time to engage of fifteen minutes from the moment a detection crosses the threshold.
The watch floor has been live for over a year. What FOC adds is depth: the AI analyst team now carries the full triage volume around the clock, which means human operators spend their hours on the cases that deserve human judgment — investigation, containment decisions, and the conversations with client teams that machines should not be having.
The shift never rotates out of the country. It never has, and at full capability, it never needs to.
Detection logic, response playbooks, and client telemetry all live on the same sovereign data model as FABRIC Exposure and Assurance. When MDR contains an incident, the root cause flows into Assurance for verified closure, and the external surface that allowed it is re-checked by Exposure — one fabric, closing its own loop.
For enrolled organizations, nothing changes on the wire — and that is the point. The SLAs you signed are now backed by a floor running at its designed capacity. For organizations evaluating MDR: we host assessments on site in Riyadh. Walk the floor, meet the operators, and watch a case worked live before you sign anything.