48hrs+ → 15min
A complex production fix, end-to-end.
Industry baseline for an equivalent incident: 48 hours or more. The LivingOps prototype ships a tested fix to a Git branch in fifteen minutes. Not by speeding hands: by removing the archaeology.
Brownfield
Where systems already exist.
The institutional memory has to be recovered before it can be operated. Brownfield is its own discipline.
The Discipline01 / 05
Why Brownfield Is Its Own Discipline
Discovery First. Design Second.
A different starting state, a different risk profile, a different return shape, a different team composition, and different success criteria. The brownfield engagement begins with discovery, not design: what the system actually does, why it was built that way, and where its memory now lives, if anywhere.
The Stakes02 / 05
18-24 months to pivot, if they could
Foreign incumbents structurally cannot close it.
Global SIs charge a rediscovery tax at every engagement. Offshore AI-SREs have no in-Kingdom presence, no Arabic, no white-box architecture. Meeting NCA flow-down would require a ground-up redesign.
~$100B
The sovereignty leak · 2026. Kingdom AI investment; the operations layer beneath it, largely foreign.
NCA flow-down breaks the moment a vendor operates from abroad.
Of every program's lifetime cost, 60 to 80 percent flows to operations: run from outside the Kingdom, in foreign languages, with knowledge that rotates out on every contract. Audit trails depend on whoever is on call, and pilots that succeeded as proofs of concept sit stalled, never having reached production. That is not a budget line. It is a sovereignty leak.
The Regulatory Floor03 / 05
The Gray Area Is Closed.
Driven by Vision 2030, the Kingdom's digital mandates have moved from directional guidelines to enforced statute. Four mechanisms now reach legacy infrastructure directly.
NCA · Enforcement01 / 04
Fines to 25M SAR, published at the violator’s expense.
Following Royal Decree M/117 in late 2024, the National Cybersecurity Authority can levy fines of up to 25 million SAR for severe non-compliance, such as deliberately operating unpatched, end-of-life edge systems, and can publish violation decisions publicly at the violator’s expense. The Essential Cybersecurity Controls forbid end-of-life software outright.
SDAIA · PDPL02 / 04
72 hours to notify. Fully enforced since 2024.
The Personal Data Protection Law applies to any entity processing the personal data of Saudi residents: a documented lawful basis, a mandatory 72-hour breach notification to SDAIA for high-risk incidents, strict safeguards on cross-border transfers, and a named Data Protection Officer with a maintained record of processing activities.
DGA · Cloud-First03 / 04
The procurement gateway is mandatory.
New on-premise infrastructure cannot simply be purchased. Cloud solutions are evaluated first, SaaS before PaaS before IaaS, and the DGA’s Cloud Computing Adoption Team reviews the evaluations. Data classified Secret or Top Secret must remain on sovereign, in-Kingdom infrastructure.
EXPRO · Budget04 / 04
Non-compliant funding is blocked.
The expenditure authority reviews every government tender. Budget requests for on-premise hardware or perpetual licenses require a formal cloud evaluation, and funding to replace hardware beneath software that violates NCA compliance is rejected. Falling behind also drags the entity’s national Qiyas score.
None of this is an argument. It is the operating environment. Brownfield work in the Kingdom now begins from it.
Four Services04 / 05
Where I Engage.
Each service ends at the same living specification. What differs is where the engagement begins.
Sovereign Cloud Migration.
Migration to in-Kingdom regions with LivingOps built in from day one. The specification lands as the migration lands, not after.
Legacy Modernization.
Modernization with the System Twin as the byproduct, not as a separate phase. When the legacy system is replaced, its memory is not lost.
AI Pilot Rescue.
Forensic diagnosis of a stalled pilot. A clear decision to revive or retire. Where revive is chosen, LivingOps is the vehicle.
AI Pilot-to-Production.
Hardening a working proof of concept into an operating system. The methodology that made it work in dev makes it survive in prod.