Technical testing and governance advice, from
one practice.

Penetration testing

Testing of web applications, APIs and LLM-based applications for exploitable weaknesses. Each finding comes with evidence, a severity rating and a practical fix, followed by a retest once remediated.

• OWASP Top 10:2025OWASP Foundation
• OWASP API Security Top 10 2023OWASP Foundation
• OWASP Top 10 for LLM Applications 2025OWASP GenAI Security Project
• OWASP Web Security Testing Guide (WSTG) v4.2OWASP Foundation

Security automation

Automated security testing built into your development pipeline: authenticated dynamic testing, API contract tests and regression checks, so known weaknesses are caught before release.

• OWASP ASVS 5.0Application Security Verification Standard
• NIST SP 800-218Secure Software Development Framework (SSDF) Version 1.1
• OWASP DevSecOps GuidelineOWASP Foundation

Data protection and privacy

Compliance programmes for Indonesian and European data protection law: data mapping, data protection impact assessments, controller and processor arrangements, and DPO advisory.

• Law No. 27 of 2022Personal Data Protection Law, Republic of Indonesia
• Regulation (EU) 2016/679General Data Protection Regulation (GDPR)
• ISO/IEC 27701:2025Privacy information management systems: Requirements and guidance

Security governance and risk

Security risk assessments, information security management system readiness, and policies that match how your organisation actually works.

• ISO/IEC 27001:2022Information security management systems: Requirements
• ISO/IEC 27002:2022Information security controls
• ISO/IEC 27005:2022Guidance on managing information security risks
• NIST CSF 2.0The NIST Cybersecurity Framework 2.0