BorneoSec is an Indonesian cybersecurity initiative focused on offensive security, vulnerability research, and practical security assessment. We help organizations identify, understand, and reduce security risks before they become real-world incidents.
Trusted at scale
From national banks to regional energy operators, security and risk leaders across ASEAN use our engagements to make defensible decisions.
Selected clients across regulated sectors
About BorneoSec
PT Borneo Secode Digital is an Indonesian cybersecurity company founded by Rahmadhani NovianJaya and Muhammad Zaid Ghiffari, with a focus on offensive security, vulnerability research, and practical security assessment.
We believe that effective security assessment goes beyond automated scanning and checklist-based reviews. BorneoSec takes an adversary-focused approach to security, combining technical testing and vulnerability research to identify weaknesses that may expose organizations to real-world attacks.
Our assessments are designed to provide clear technical evidence, practical risk analysis, and actionable recommendations that help organizations understand and improve their security posture. BorneoSec provides cybersecurity services across application security, infrastructure security, vulnerability assessment, penetration testing, security research, and security consulting.
Head Office
Our Services
Six practice areas, delivered by the same senior team. Engagements can be scoped individually or combined into a continuous security programme.
Manual, objective-driven testing across web, mobile, API, cloud, and internal network estates — mapped to OWASP, PTES, and OJK expectations.
Full-scope, intelligence-led attack simulation that measures how your detection and response functions perform under real pressure.
Configuration review and exploitation testing for AWS, Azure, GCP, and container platforms, including identity and privilege escalation paths.
Readiness and audit support for ISO/IEC 27001, PCI DSS, OJK POJK 11/2022, and UU PDP with practical, engineering-first remediation.
24/7 retainer-backed containment, digital forensics, and root-cause analysis delivered by responders based in-region.
Secure SDLC enablement, code review, and hands-on offensive training that upskills your internal engineering and blue teams.
Why Choose Us
Most security vendors sell coverage. We sell certainty — findings you can reproduce, prioritise, fix, and prove closed.
Every engagement is executed by OSCP, OSEP, and CRTO-certified consultants. Automated tooling supports our work — it never replaces it.
Reports include reproducible proof-of-concept steps, business-impact ratings, and remediation code samples your engineers can apply immediately.
Documentation is structured for OJK, BSSN, Kominfo, and external auditors, reducing the effort your compliance team spends translating findings.
All engagement data is processed and stored on Indonesian infrastructure, aligned with UU PDP and sector-specific residency requirements.
Every engagement includes a complete retest cycle within 90 days so you can prove closure to your board and your auditors.
Our lab publishes original vulnerability research and detection tooling, so our tradecraft reflects the current threat landscape.
The typical vendor report
The BorneoSec engagement
Methodology
Every engagement follows the same disciplined lifecycle, aligned to internationally recognised frameworks so results are repeatable and defensible.
We define objectives, critical assets, threat scenarios, and escalation paths with your stakeholders before a single packet is sent.
OSINT, attack-surface mapping, and sector-specific threat intelligence establish how a real adversary would approach your organisation.
Manual exploitation, privilege escalation, and lateral movement — safely executed and continuously logged for full auditability.
Findings are triaged with CVSS v4 plus a business-impact layer so leadership can prioritise on risk, not raw severity counts.
You receive a technical report, an executive summary, and a live walkthrough with the consultants who performed the work.
We advise your engineers throughout remediation, then formally retest and issue an attestation letter for auditors.
Every engagement concludes with a documentation set designed for three different audiences: your engineers, your executives, and your auditors.
Industries
Regulatory context matters as much as technical depth. Our consultants understand the supervisory expectations that apply to your sector.
POJK-aligned testing for core banking, mobile banking, and payment switching environments.
BSSN-aligned assessments for national and regional digital services and citizen data platforms.
OT/ICS and IT-OT boundary testing for Kalimantan's resource and power operators.
Core network, BSS/OSS, and subscriber platform security for carriers and ISPs.
Clinical system, EMR, and medical device assessments protecting patient data.
Continuous testing that keeps pace with high-velocity product and platform teams.
Leadership
Our leadership team came from the red teams, audit floors, and research labs of Indonesia's most regulated organisations.
THx17k Co-Founder & Chief Executive Officer
Cybersecurity professional with 7 years of experience across the FMCG and mining industries, specializing in offensive security, penetration testing, vulnerability research, and information security.
Request an introduction
Zheev Co-Founder & Chief Hacking Officer
Security researcher and penetration tester with experience in vulnerability research, bug bounty, and offensive security. Active in cybersecurity since 2019, with multiple CVE credits and recognition from global security platforms.
Request an introductionMedia coverage
Journalists and industry analysts cite our disclosures because we publish responsibly and explain impact clearly.
BorneoSec ungkap celah kritikal pada platform pembayaran regional
Indonesian security firms move up the offensive security value chain
Research lab in Borneo credited with 38 CVEs across enterprise software
Sektor energi Kalimantan percepat kesiapan keamanan OT
Insights
Practical guidance on Indonesian regulatory expectations, offensive tradecraft, and defensive engineering.
A practical breakdown of how Indonesian financial institutions can align penetration testing scope, frequency, and reporting with OJK expectations.
Field notes from assessing operational technology environments across mining and power generation sites, and the four boundary weaknesses we find repeatedly.
The two are routinely confused during procurement. Here is how to decide which one answers the question your board is actually asking.
Common questions
If your question isn't covered here, our engagement leads will answer it directly on an introductory call.
Standard penetration tests are typically scheduled within 10 business days of a signed statement of work. Incident response retainer clients receive same-day mobilisation.
All evidence, findings, and reports are processed and retained on Indonesian infrastructure with encryption at rest, aligned to UU PDP requirements.
Yes. Every fixed-scope engagement includes one full remediation retest within 90 days and a formal attestation letter suitable for auditors.
Our deliverables are structured for regulator submission, and our consultants routinely join audit interviews to explain findings and remediation evidence.
Start an engagement
Tell us about your environment and objectives. An engagement lead — not a sales representative — will respond within one business day with a scoped proposal.
General & new engagement enquiries
Active incident — monitored 24/7
Mon–Fri, 08:00–18:00 WIB
Jl. Samekto Barat No 33
Sampit, Kotawaringin Timur, Kalimantan Tengah 74313