Are you CREST accredited?

No — and we do not claim to be. Our methodology is CREST-aligned: CREST-style scoping, evidence handling and reporting. Delivery is by OSCP-certified consultants, and our NACSA registry submission is pending verification. If a tender requires a CREST-accredited supplier, tell us early and we will say so plainly.

The platform tiers below are indicative monthly bands. Engagement scope determines the final fixed fee, which is agreed in writing before work starts. MYR pricing and the included retest are confirmed in the scoped quote.

Do you only test, or do you help us fix it?

Both. Findings arrive with reproduction steps and remediation guidance, and we retest at no extra charge once you have made the change. We also run hardening and ISMS advisory work where teams want the follow-through.

Will the report satisfy our auditor or Bank Negara?

That is the point of the mapping. Findings are tied to the framework control your auditor or regulator cites — RMiT Appendix 10, ISO 27001 Annex A, SOC 2 criteria, PCI DSS — with proof-of-concept evidence attached, in both BM and EN where needed.

Can our own customers see our security posture?

Yes. The platform includes read-only rooms for auditors and for your customers, so a prospect's security review can be answered from live control status instead of a PDF you email out.

Malaysian delivery team · Founded 2020

Break it before attackers do. Prove it stays fixed.

Manual-led penetration testing and continuous compliance evidence for Malaysian teams that need findings they can fix — and proof an auditor can trust.

Get a scoped quote See the platform

Free retest included BM + EN reporting 24/7 IR hotline

Live findings

CURRENT ENGAGEMENT

Fintech API assessment

Testing

IDOR on /api/v2/statements — cross-tenant read

critical severity

9.1

JWT alg confusion → auth bypass

critical severity

9.8

Race condition in FPX payment callback

high severity

8.2

Open

Evidence

24h

Critical SLA

OSCP-certified consultantsCREST-aligned methodologyPTES · OWASP WSTG · NIST 800-115MYR pricing

Offensive security

Testing that ends with a fix, not a PDF.

Every engagement combines manual testing, evidence, remediation guidance and an included retest.

Penetration testing

Web, mobile, API, cloud, network and wireless — manual-led, PTES and OWASP WSTG methodology, CVSS-scored findings with proof of concept.

Web appMobileAPICloudNetwork

Red team & adversary emulation

Full attack-path work: perimeter recon, lateral movement, social engineering and physical, scoped with rules of engagement.

Red teamSocial engineeringPhysical

Compromise assessment & forensics

Incident-driven review of what happened, with chain-of-custody handling for anything that may end up in front of a regulator.

IR-drivenDigital forensics

Attack surface & vulnerability management

Continuous external exposure monitoring plus recurring scanning with human verification, so the queue is real findings only.

ASMRecurring scansVerified

Compliance advisory

Gap baselines and audit preparation for RMiT, ISO 27001, PDPA, PCI DSS, SOC 2 and Cyber Security Act readiness.

Gap assessmentISMSAudit prep

Managed detection & response

MDR and SOC-as-a-service with a 24/7 incident response hotline and threat intelligence including dark-web brand exposure.

MDRSOCThreat intel

nCrypt Radar

Evidence that stays current after the test ends.

Findings, controls, evidence and audit access in one secure workspace — without spreadsheet archaeology.

Findings with SLA clocks

Critical 24 hours, high 7 days, medium 30, low 90 — measured from the moment the finding lands, not from when someone reads the report.

Evidence vault with a hash trail

Every artefact fingerprinted on upload so an auditor can prove what was collected and when.

Continuous control monitoring

Automated tests re-evaluate your controls daily; a failing test marks the control it maps to as non-compliant.

Auditor and client access

Read-only rooms for your auditor and your own customers, instead of emailing PDFs around.

Walk through the platform

CONTROL HEALTH

92% compliant

AWS

Google Workspace

Okta

GitHub

Jamf Pro

SentinelOne

Cloudflare

Jira

Slack

Evidence freshness148 / 161 current

How engagement works

From scope to audit-ready proof.

148 hours

Scope

You tell us the estate and the driver — an audit, a customer requirement, a board question. We come back with scope, fee and dates in writing.

2Engagement window

Test

Manual-led testing against PTES, OWASP WSTG and NIST 800-115, with findings raised as they are confirmed rather than held to the end.

3Your sprint

Remediate

Findings arrive in the platform with reproduction steps and a fix owner, ordered by severity and SLA rather than by page number.

4Included

Retest & attest

We verify the fixes at no extra charge, then package the evidence mapped to the framework your auditor or regulator asks about.

Hundreds

Engagements delivered

Across regulated sectors since 2020

OSCP

Certified consultants

Plus CEH; CREST-aligned methodology

2 hrs

Average response time

24/7 incident response hotline

GMT+8

Local delivery

MYR pricing, BM and EN reporting

Compliance mapping

One control. Every framework it satisfies.

Collect evidence once, map it to Malaysian and global requirements, and keep the audit trail live.

Malaysian financial

Bank Negara RMiT 10.4

Mandatory for MY banks

Risk Management in Technology for licensed financial institutions, banks, DFIs and digital insurers.

Data protection

Malaysia PDPA 2010/2025

7 mandatory principles

Personal Data Protection Act 2010 and the 2025 amendments, for data controllers and processors in Malaysia.

NCII infrastructure

NACSA Cyber Security Act 2024

Akta 854

National Cyber Security Agency compliance for National Critical Information Infrastructure entities.

Global standard

ISO 27001:2022 ISMS

93 Annex A controls

Information Security Management System certification readiness with automated evidence collection.

SaaS trust standard

SOC 2 Type II

Automated 24/7 checks

Trust Services Criteria — security, availability, confidentiality and privacy — for global enterprise deals.

Payment security

PCI DSS v4.0

6 control objectives

Payment Card Industry Data Security Standard for merchants and payment service providers in ASEAN.

Platform pricing

Pricing that scales with your assurance programme.

Start with one framework, then reuse the same controls and evidence as requirements grow.

Essentials

One framework, continuous monitoring, and the trust room.

RM 1,900/ month

Start with one framework

One framework — SOC 2, ISO 27001 or PDPA

Continuous control monitoring, re-run every 24h

Evidence vault with hash trail

Trust room with access requests

Policy templates and acknowledgement tracking

Growth

Multi-framework, annual pentest included, auditor access.

RM 3,800/ month

Get a scoped quote

Everything in Essentials

Unlimited frameworks with shared controls

Annual manual pentest with free retest

Auditor room with read-only evidence access

Vendor risk and access reviews

Questionnaire AI with citations

Enterprise

For regulated teams with their own auditors and SLAs.

Scopedquoted per engagement

Talk to an engineer

Everything in Growth

Quarterly testing and red team options

RMiT, PCI DSS and NACSA readiness programmes

SSO, SCIM and a named delivery lead

Contractual SLAs and BM + EN reporting

Pentest scoping

Build a first-pass scope in under a minute.

Choose what needs testing. We will validate the assumptions, fee and dates with you in writing before work starts.

No obligation. Engineer-led response within two hours on average.

ESTIMATED DURATION

3–5 days

ITEMS IN SCOPE

Typical for this shape: one window, findings raised as they're confirmed, retest 2 weeks after sign-off.

Send this scope

Straight answers

Questions teams ask before scoping.

Ready to know what is actually exposed?

Tell us the estate and the deadline. An engineer will come back with scope, fee and dates — usually within two hours.

Get a scoped quote WhatsApp an engineer