How long does an engagement take?

A web application pentest runs 5–10 business days of active testing plus reporting. An API engagement runs 4–12 testing days. Internal network and Active Directory programmes take 7–14 testing days. A full intelligence-led red team simulation runs 3–6 weeks end to end. Reporting and QA sit in a separate window after testing ends, and a free retest of fixed findings is typically scheduled 30–60 days after the final report.

Is nCrypt a CREST-Aligned company?

Our engagements are scoped to CREST-aligned practice and staffed with certified offensive-security consultants holding credentials such as OSCP, OSCE, OSWE, CEH, GPEN, GWAPT and CISSP where suitable. If your tender requires a specific accreditation or per-consultant credential evidence, share the wording during scoping and we will confirm in writing which consultants and credentials can be assigned.

Do you meet Bank Negara RMiT requirements?

Financial-sector engagements are scoped against BNM's Risk Management in Technology policy, including independent penetration testing, intelligence-led testing for significant institutions, remediation tracking and management attestation. We deliver retest letters, control-to-finding mapping and a remediation register suitable for board reporting and BNM examination evidence, and can phase programmes against RMiT control domains rather than running one-off tests.

Is the methodology aligned with OWASP, PTES and NIST?

Yes. The lifecycle follows PTES; web and API testing follows the OWASP Testing Guide and Top 10; mobile follows OWASP MASVS; technical assessment follows NIST SP 800-115; and adversary technique coverage follows MITRE ATT&CK. Cloud reviews additionally use CIS Benchmarks for AWS, Azure and GCP, so findings translate into ISO 27001, PCI DSS, SOC 2 and RMiT without redoing the work.

How do you handle PDPA and our data?

Before testing starts we sign mutual NDAs, agree rules of engagement, restrict handling to named consultants, and avoid extracting personal data unless it is necessary to demonstrate impact — in which case samples are masked. Evidence is held on encrypted infrastructure, access-logged and destroyed on a defined schedule. Findings can also be mapped against the PDPA Security Principle and your DPO's risk register.

How do we get started?

Three steps: a free 15-minute scoping call to understand your environment and drivers; mutual NDA exchange so we can review architecture diagrams, target lists and any prior reports; then a written proposal within 48 hours covering scope, methodology, testing window, team credentials, deliverables and commercials. Kickoff is typically within 5–10 business days of signing.

CREST-aligned · OSCP-certified consultants

Penetration testing
services Malaysia.

Web, API, mobile, cloud, network and red team scopes. Our consultants validate real business impact by hand, then deliver Bank Negara RMiT, PDPA, PCI DSS and ISO 27001-ready evidence.

Request a quote Call +6012 770 7421

CONSULTANT CERTIFICATIONS

CREST-alignedOSCPOSCEOSWECEHGPENGWAPTCISSP

Web Application Pentest — Final Report

NCR-2026-0714 · OWASP WSTG · CVSS 3.1

RETESTED

2 Critical5 High9 Medium14 Low

IDOR on /api/v2/statements — cross-tenant read9.1Fixed

JWT alg confusion → auth bypass9.8Fixed

Race condition in FPX payment callback8.2Fixed

PoC evidence attachedSample report →

Core testing scopes

RMiT

Evidence mapping

Manual

Exploit validation

90-day

Free remediation retest

CHOOSE A SCOPE

What to test, how long it takes, what you get

If you are comparing providers, the difference is not the scanner list. It is whether the team can prove exploitability and produce evidence your auditor, board and engineers can all use.

SCOPEBEST FORTYPICAL DURATIONDELIVERABLE

Web application pentestCustomer portals, SaaS apps, ecommerce, internet banking and admin panels.5–15 testing daysOWASP findings, exploit evidence, business logic review and retest letter.

API penetration testingREST, GraphQL, mobile backend and partner integration APIs.4–12 testing daysAuth bypass, object-level authorization, rate-limit and data exposure analysis.

Network and AD pentestInternal networks, VPN, cloud connectivity and Microsoft Active Directory.5–20 testing daysAttack-path mapping, privilege escalation proof and Tier 0 remediation plan.

Red team assessmentBanks, critical infrastructure and mature teams testing detection and response.3–8 weeksObjective-based attack narrative, detection gaps and board-level debrief.

EXPAND WITHOUT STARTING OVER

Start with SOC 2. Every other framework gets easier.

One control maps to many frameworks. Test and evidence it once, and the same work counts toward the next standard your buyers or regulator ask for.

SOCSTART HERE

SOC 2

The usual starting point for SaaS and platform teams. One programme covers roughly 70% of what the next framework asks for.

Controls in scope84

Pentest evidenceReusable

Readiness100%

ISO 2700170%

Estimated readiness

DORA71%

Estimated readiness

UK Cyber Ess.71%

Estimated readiness

NIST CSF63%

Estimated readiness

GDPR62%

Estimated readiness

ISO 4200162%

Estimated readiness

HIPAA56%

Estimated readiness

HITRUST56%

Estimated readiness

FedRAMP41%

Estimated readiness

FDA41%

Estimated readiness

PCI DSS38%

Estimated readiness

Indicative overlap based on shared control coverage · confirmed against your estate during scoping

COVERAGE & SCOPES

Comprehensive testing

Web application

OWASP Top 10, business logic flaws, authentication bypass and session management testing.

OWASP Top 10 coverageBusiness logic testingAuthentication testing

Mobile application

iOS and Android testing including static analysis, dynamic testing and reverse engineering.

iOS and AndroidReverse engineeringData storage analysis

API security

REST, GraphQL, SOAP and gRPC testing for authentication, authorization and data exposure.

REST and GraphQLAuthentication bypassRate-limit assessment

Cloud security

AWS, Azure and GCP assessments including misconfiguration and IAM analysis.

AWS, Azure, GCPMisconfiguration detectionIAM security analysis

Network security

Internal and external network assessments including Active Directory and privilege escalation.

Internal and externalActive Directory testingPrivilege escalation

Red team operations

Full adversary simulation combining physical, digital and social engineering attack paths.

Full attack simulationPhysical security testingThreat intelligence

Wireless security

WiFi, Bluetooth and RF testing to identify vulnerabilities and rogue access points.

WiFi security testingRogue AP detectionWPA2 / WPA3 testing

Social engineering

Phishing campaigns, vishing, pretexting and physical security testing.

Phishing campaignsVishing and pretextingAwareness validation

IoT security

Device and embedded system testing including firmware analysis and protocol testing.

Firmware analysisProtocol testingHardware security

METHODOLOGY

Rigorous standard execution

Scoping and planning

Define objectives, rules of engagement and timeline. Gather target information and obtain authorisations.

Reconnaissance

Passive and active information gathering to understand the attack surface and identify entry points.

Vulnerability analysis

Identify and validate weaknesses using automated tooling plus manual testing techniques.

Exploitation

Safely exploit vulnerabilities to demonstrate real-world impact and assess exploitability.

Post-exploitation

Assess the access gained, lateral movement potential and possible data exposure.

Reporting

Deliver findings with risk ratings, proof of concept and remediation guidance.

DELIVERABLES

What lands at the end of the engagement

Board-ready executive summary

What was tested, what an attacker could achieve, and what it means commercially.

Technical report with CVSS-scored findings

Reproduction steps for every finding so engineers can confirm the issue themselves.

Proof-of-concept evidence captures

Screenshots and request/response evidence, with personal data masked.

Prioritised remediation guide

Written for the engineering team and ordered by exploitability, not page number.

Attestation letter

Suitable for customers, procurement and regulators.

Retest report

Free verification after fixes deploy, typically scheduled 30–60 days after the final report.

Why teams pick nCrypt

CREST-aligned, OSCP-certified

Engagements follow CREST-style scoping, evidence and reporting discipline; consultants hold OSCP, OSCE and OSWE.

BNM RMiT evidence mapping

Financial-sector findings map into RMiT remediation and board-reporting workflows.

Reports engineers can act on

Clear risk ratings, reproduction steps and remediation, not a scanner export.

Retest included

Free verification testing after remediation, so fixes are proven rather than assumed.

ACCREDITATIONS & TECHNOLOGY PARTNERS

ALL SCOPES

Related services

Web application penetration testing

OWASP Top 10, auth, APIs and business logic

Mobile application penetration testing

iOS, Android, API traffic and device storage

API penetration testing

REST, GraphQL, auth flows and data exposure

Cloud penetration testing

AWS, Azure, GCP and cloud control-plane risk

Network penetration testing

Internal, external, segmentation and privilege paths

Red team operations

Adversary simulation and executive evidence

Wireless penetration testing

Corporate Wi-Fi, rogue AP and WPA enterprise risk

Social engineering testing

Phishing, vishing and awareness validation

IoT penetration testing

Embedded devices, firmware and exposed services

CREST-aligned penetration testing

Assurance format for regulated procurement

Intelligence-led penetration testing

Threat-led scopes for higher-risk environments

Questions buyers ask

Pricing is scoping-based rather than packaged, because cost is driven by asset count, application complexity, authenticated user roles, compliance evidence requirements and retesting needs. A focused web application or API engagement sits at the lower end; multi-environment network, cloud and Active Directory programmes or red-team assessments sit higher because they take more testing days and senior consultants. A 15-minute scoping call usually produces an accurate proposal within 48 hours of NDA exchange.

Tell us the scope.
Proposal within 48 hours.

A free 15-minute scoping call, mutual NDA, then a written proposal covering scope, methodology, testing window, consultant credentials and commercials. Kickoff is typically 5–10 business days after signing.

Request a pentest quote WhatsApp +60 12-770 7421

[email protected] · Mon–Fri 9AM–6PM MYT · 24/7 incident response hotline

Rough it out firstNO OBLIGATION

Pick what's in scope. We'll confirm the exact fee after the scoping call.

Targets selected2

Indicative testing days3–5 days

Report + retestIncluded

Typical for this shape: one window, findings raised as they're confirmed, retest 30–60 days after sign-off.

Send this scope

What lands at the end of the engagement

Board-ready executive summary

What was tested, what an attacker could achieve, and what it means commercially.

Technical report with CVSS-scored findings

Reproduction steps for every finding so engineers can confirm the issue themselves.

Proof-of-concept evidence captures

Screenshots and request/response evidence, with personal data masked.

Prioritised remediation guide

Written for the engineering team and ordered by exploitability, not page number.

Attestation letter

Suitable for customers, procurement and regulators.

Retest report

Free verification after fixes deploy, typically scheduled 30–60 days after the final report.

Questions buyers ask

Tell us the scope.
Proposal within 48 hours.

[email protected] · Mon–Fri 9AM–6PM MYT · 24/7 incident response hotline

Penetration testingservices Malaysia.

What to test, how long it takes, what you get