Loading...
CREST-aligned methodology · Selangor, Malaysia · GMT+8Real security.
Real security.
Provable compliance.
We run the offensive security program — manual pentests, hardening, retests — and hand you evidence Bank Negara, auditors and enterprise buyers actually accept. RMiT, ISO 27001, SOC 2, PDPA.
Scoped in 48h · Fixed fee · Free retest included
Web Application Pentest — Final Report
NCR-2026-0714 · OWASP WSTG · CVSS 3.1
2 Critical5 High9 Medium14 Low
IDOR on /api/v2/statements — cross-tenant read9.1Fixed
JWT alg confusion → auth bypass9.8Fixed
Race condition in FPX payment callback8.2Fixed
Mapped to BNM RMiT Appendix 10 · PoC evidence attachedSample report →
EVIDENCE MAPPED TO
BNM RMiTPDPA 2024ISO 27001SOC 2PCI DSSAct 854 · NACSANIST CSF
SERVICES
Manual-led offensive work, not a scanner with a logo on it
Scanner-only vendors sell PDFs. We test by hand, then map every finding to the framework your regulator or auditor asks about — in the format they expect.
01
Penetration testing
Web, mobile, API, cloud, network and wireless — manual-led, PTES and OWASP WSTG methodology, CVSS-scored findings with proof of concept.
Web appMobileAPICloudNetwork
02
Red team & adversary emulation
Full attack-path work: perimeter recon, lateral movement, social engineering and physical, scoped with rules of engagement.
Red teamSocial engineeringPhysical
03
Compromise assessment & forensics
Incident-driven review of what happened, with chain-of-custody handling for anything that may end up in front of a regulator or court.
IR-drivenDigital forensicsSection 90A
04
Attack surface & vulnerability management
Continuous external exposure monitoring plus recurring scanning with human verification, so the queue is real findings only.
ASMRecurring scansVerified
05
Compliance advisory
Gap baselines and audit preparation for RMiT, ISO 27001, PDPA, PCI DSS, SOC 2 and Cyber Security Act readiness.
Gap assessmentISMSAudit prep
06
Managed detection & response
MDR and SOC-as-a-service with a 24/7 incident response hotline and threat intelligence including dark-web brand exposure.
MDRSOC24/7 Hotline
ACCREDITATIONS & TECHNOLOGY PARTNERSVendor-neutral — we deploy what fits the estate
THE PLATFORMSee a platform walkthrough
Your findings and your controls, on the same evidence
Every engagement lands in the nCrypt platform: findings scored with CVSS and SLA clocks running, controls evaluated continuously, and one evidence vault your auditor can read from directly.
Findings with SLA clocks
Critical 24 hours, high 7 days, medium 30, low 90 — measured from the moment the finding lands, not from when someone reads the report.
Evidence vault with a hash trail
Every artefact fingerprinted on upload so an auditor can prove what was collected and when.
Continuous control monitoring
Automated tests re-evaluate your controls daily; a failing test marks the control it maps to as non-compliant.
Auditor and client access
Read-only rooms for your auditor and your own customers, instead of emailing PDFs around.
Control status — SOC 284 / 84 PASSING
84 Compliant0 Non-compliant
Integrations syncing evidence12 ACTIVE
AWSAWS
GCPGoogle Cloud
GGoogle Workspace
OKOkta
GHGitHub
GLGitLab
CFCloudflare
JRJira
FTNFortinet
SPLSplunk
SNKSnyk
1P1Password
Automated checks re-run every 24 hours. A failed sync pauses the controls it feeds and flags the owner the same hour.
HOW WE WORK
Scoped in 48 hours. Fixed fee. Retest included.
No day-rate creep and no surprise line items. You get the scope, the fee and the dates in writing before anyone touches a system.
0148 hours
Scope
You tell us the estate and the driver — an audit, a customer requirement, a board question. We come back with scope, fee and dates in writing.
02Engagement window
Test
Manual-led testing against PTES, OWASP WSTG and NIST 800-115, with findings raised as they are confirmed rather than held to the end.
03Your sprint
Remediate
Findings arrive in the platform with reproduction steps and a fix owner, ordered by severity and SLA rather than by page number.
04Included
Retest & attest
We verify the fixes at no extra charge, then package the evidence mapped to the framework your auditor or regulator asks about.
MYR pricing · BM + EN reporting · No lock-in · Pricing is engagement-specific — quoted after scoping
Hundreds
Engagements delivered
Across regulated sectors since 2020
OSCP
Certified consultants
Plus CEH; CREST-aligned methodology
2 hrs
Average response time
24/7 incident response hotline
GMT+8
Local delivery
MYR pricing, BM and EN reporting
Credentials, stated plainly
We say aligned where we are aligned and in progress where it is in progress.
CREST
CREST-aligned methodology
CREST-style scoping, evidence handling and reporting methodology.
OSCP
OSCP certified consultants
Offensive Security Certified Professional consultants on delivery.
ISO 27001
ISO 27001 audit in progress
Our own ISMS certification audit is currently in progress.
NACSA
NACSA licence pending
Licensing under the Cyber Security Act 2024 is in progress, not granted.
COMPLIANCE
The frameworks Malaysian teams are actually asked about
Malaysian financialMandatory for MY banks
Bank Negara RMiT 10.4
Risk Management in Technology for licensed financial institutions, banks, DFIs and digital insurers.
Explore framework
Data protection7 mandatory principles
Malaysia PDPA 2010/2025
Personal Data Protection Act 2010 and the 2025 amendments, for data controllers and processors in Malaysia.
Explore framework
NCII infrastructureAkta 854
NACSA Cyber Security Act 2024
National Cyber Security Agency compliance for National Critical Information Infrastructure entities.
Explore framework
Global standard93 Annex A controls
ISO 27001:2022 ISMS
Information Security Management System certification readiness with automated evidence collection.
Explore framework
SaaS trust standardAutomated 24/7 checks
SOC 2 Type II
Trust Services Criteria — security, availability, confidentiality and privacy — for global enterprise deals.
Explore framework
Payment security6 control objectives
PCI DSS v4.0
Payment Card Industry Data Security Standard for merchants and payment service providers in ASEAN.
Explore framework
PRICING
One platform fee. Testing included from Growth up.
Indicative bands so you can budget. The final fee is fixed and quoted after scoping — no day-rate creep.
Starter
Continuous compliance tracking and automated evidence collection for growing teams.
RM 2,125/ month · billed annually
Start Starter1 Compliance Framework (SOC 2 or ISO 27001)
Continuous automated evidence sync
Automated vulnerability scanner tracking
Evidence vault with hash trail
Read-only auditor room
Growth
MOST CHOSENFull offensive testing program bundled with continuous compliance monitoring.
RM 5,525/ month · billed annually
Get Growth ScopeEverything in Starter
1x Annual Manual Penetration Test included
Free retest & remediation attestation
Up to 3 Compliance Frameworks (RMiT / PDPA / ISO)
SLA timer tracking (Critical 24h, High 7d)
Priority Slack & WhatsApp engineering support
Scale
Enterprise multi-framework coverage, continuous pentesting, and 24/7 incident support.
RM 12,325/ month · billed annually
Contact EnterpriseEverything in Growth
2x Annual Manual Penetration Tests (Web/API/Mobile)
Unlimited Compliance Frameworks
Quarterly Attack Surface & External Asset Scans
24/7 Incident Response hotline SLA
Custom auditor & board-level PDF generators
Indicative only · MYR, excl. SST · Final fee fixed after scoping · Retest included on every engagement
Questions we get on every call
No — and we do not claim to be. Our methodology is CREST-aligned: CREST-style scoping, evidence handling and reporting. Delivery is by OSCP-certified consultants, and our NACSA registry submission is pending verification. If a tender requires a CREST-accredited supplier, tell us early and we will say so plainly.
Tell us the scope.
We come back in 48 hours.
Talk to an engineer, not a sales deck. Fixed fee, dates in writing, retest included — and evidence packaged for whoever is asking.
[email protected] · Mon–Fri 9AM–6PM MYT · 24/7 incident response hotline
Rough it out firstNO OBLIGATION
Pick what is in scope. We will confirm the exact fee after a 20-minute call.
Targets selected2 targets
Indicative field time~5 business days
Report + retestIncluded (RM 0)