NovaSec
Client login Request a pentest

AI-DRIVEN · GOVERNANCE-GATED · MALAYSIA-READY

Continuous penetration testing, without the enterprise price tag.

Automated offensive-security testing mapped to the OWASP Top 10 and Malaysian compliance (PDPA, RMiT, NACSA) — delivered as a clear, human-reviewed report you can hand to a regulator or a client.

Request a pentest See a sample report
Mapped to OWASP Top 10 PDPA 2010 BNM RMiT NACSA ISO/IEC 27001 PCI-DSS SOC 2 GDPR · HIPAA

What we test

Every test a real attacker runs — in one governed platform.

We combine vetted open-source offensive tooling with our own checks, run only against assets you have authorized in writing, and every action is scope-locked and audited. You get the depth of a manual pentest with the cadence and price of automation.

A03 · A07

Web application

Injection, XSS, access control, auth & session flaws across the OWASP Top 10.

NMAP

Network & ports

Open ports and exposed services — databases, admin panels, forgotten daemons.

TLS · PQC

Crypto & post-quantum

Weak TLS/ciphers and post-quantum key-exchange readiness (store-now-decrypt-later).

DNS

Email spoofing

SPF, DMARC and CAA — the records that stop attackers spoofing your domain.

SECRETS

Exposed secrets

Leaked API keys and tokens in client-side code and hidden files.

AI

Prompt-injection

Canary-based prompt-injection and system-prompt leakage on AI endpoints.

CLOUD

Cloud exposure

Public S3 / Google Cloud storage buckets and cloud provider fingerprinting.

AUTH

Default & weak creds

Classic default logins (admin/admin) and authenticated session hygiene.

How it works

Authorized. Scope-locked. Audited end to end.

Nothing is ever tested without written authorization. Every scan is bounded to the assets you approve, and every action is logged.

1

You authorize

Sign the authorization letter and approve a scope declaration — the exact assets and the testing tier we may reach. Anything not listed is out of scope.

2

We test

The platform runs the full scanner suite against only your in-scope assets. Every target is re-checked against the allowlist and written to an append-only audit trail.

3

You get the report

A branded PDF: prioritized findings with remediation, everything that passed, and your OWASP Top 10 + Malaysian & international compliance mapping.

Pricing

Simple, predictable pricing.

Subscribe for continuous assurance, or commission a one-off engagement for a point-in-time certified report.

Starter
For startups & SMEs establishing a security baseline
RM 490/mo
or RM 4,900/yr · 2 months free
  • 1 application or domain
  • Monthly automated full scan
  • OWASP Top 10 + PDPA / RMiT report
  • Post-quantum TLS readiness check
  • “Everything we tested” coverage report
  • Email support
Start with Starter
MOST POPULAR
Business
For growing SaaS, e-commerce & app teams
RM 1,490/mo
or RM 14,900/yr · 2 months free
  • Up to 5 applications or domains
  • Weekly scans — all scanners (Active tier)
  • Authenticated testing (session, default-credentials)
  • AI / prompt-injection + cloud-exposure checks
  • Retest included
  • Full compliance pack: OWASP, PDPA, RMiT, NACSA, ISO 27001, PCI-DSS, SOC 2
Choose Business
Enterprise / Regulated
For fintech, banking & government
Custom
scoped to your environment
  • Unlimited assets
  • Intrusive tier (authorized) + credentialed cloud posture audit
  • Banking-tier RMiT / NACSA compliance packs
  • Dedicated analyst review & sign-off
  • Scheduled cadence + SLA
  • On-prem / air-gapped deployment option
Talk to us
Need a one-off VAPT for a tender or audit? Point-in-time engagements with human review start from RM 6,000 (micro) / RM 18,000 (standard). Talk to us for a scoped quote.

Compliance mapping

A report your regulator and your client both understand.

Every engagement is cross-referenced to the frameworks below. This is indicative mapping derived from technical testing — not a formal certification or audit.

OWASP Top 10 (2021) PDPA 2010 (Malaysia) BNM RMiT NACSA / Cyber Security Act 2024 Malaysia AI Governance (NAIO) ISO/IEC 27001:2022 PCI-DSS v4.0 SOC 2 GDPR HIPAA CCPA / CPRA

Get started

Ready to see where you stand?

Send us your in-scope assets and a signed authorization, and we will return a full assessment — findings, everything that passed, and your compliance mapping.

Email security@novastack.com.my Request a sample report