BorneoSec is an Indonesian offensive security firm. We deliver penetration testing, red teaming, and incident response for banks, government agencies, and energy operators that cannot afford to be wrong about their defences.
Accredited & certified
Trusted at scale
From national banks to regional energy operators, security and risk leaders across ASEAN use our engagements to make defensible decisions.
Selected clients across regulated sectors
About BorneoSec
PT Borneo Secode Digital was founded in 2019 by practitioners who spent their careers inside Indonesian banks, auditors, and state enterprises. We saw the same problem repeatedly: organisations were buying scan reports and calling them security assessments.
BorneoSec was built to close that gap. Our consultants perform genuinely manual, objective-driven testing and hand back evidence that engineering teams can act on and that auditors will accept without translation.
Today we operate from Banjarbaru with delivery teams in Jakarta and regional partnerships in Singapore, supporting the sectors where a breach carries systemic consequences — financial services, government, energy, and telecommunications.
Head Office — Kalimantan Selatan
Client Delivery — DKI Jakarta
Regional Partnerships
Our Services
Six practice areas, delivered by the same senior team. Engagements can be scoped individually or combined into a continuous security programme.
Manual, objective-driven testing across web, mobile, API, cloud, and internal network estates — mapped to OWASP, PTES, and OJK expectations.
Full-scope, intelligence-led attack simulation that measures how your detection and response functions perform under real pressure.
Configuration review and exploitation testing for AWS, Azure, GCP, and container platforms, including identity and privilege escalation paths.
Readiness and audit support for ISO/IEC 27001, PCI DSS, OJK POJK 11/2022, and UU PDP with practical, engineering-first remediation.
24/7 retainer-backed containment, digital forensics, and root-cause analysis delivered by responders based in-region.
Secure SDLC enablement, code review, and hands-on offensive training that upskills your internal engineering and blue teams.
Why Choose Us
Most security vendors sell coverage. We sell certainty — findings you can reproduce, prioritise, fix, and prove closed.
Every engagement is executed by OSCP, OSEP, and CRTO-certified consultants. Automated tooling supports our work — it never replaces it.
Reports include reproducible proof-of-concept steps, business-impact ratings, and remediation code samples your engineers can apply immediately.
Documentation is structured for OJK, BSSN, Kominfo, and external auditors, reducing the effort your compliance team spends translating findings.
All engagement data is processed and stored on Indonesian infrastructure, aligned with UU PDP and sector-specific residency requirements.
Every engagement includes a complete retest cycle within 90 days so you can prove closure to your board and your auditors.
Our lab publishes original vulnerability research and detection tooling, so our tradecraft reflects the current threat landscape.
The typical vendor report
The BorneoSec engagement
Methodology
Every engagement follows the same disciplined lifecycle, aligned to internationally recognised frameworks so results are repeatable and defensible.
We define objectives, critical assets, threat scenarios, and escalation paths with your stakeholders before a single packet is sent.
OSINT, attack-surface mapping, and sector-specific threat intelligence establish how a real adversary would approach your organisation.
Manual exploitation, privilege escalation, and lateral movement — safely executed and continuously logged for full auditability.
Findings are triaged with CVSS v4 plus a business-impact layer so leadership can prioritise on risk, not raw severity counts.
You receive a technical report, an executive summary, and a live walkthrough with the consultants who performed the work.
We advise your engineers throughout remediation, then formally retest and issue an attestation letter for auditors.
Every engagement concludes with a documentation set designed for three different audiences: your engineers, your executives, and your auditors.
Industries
Regulatory context matters as much as technical depth. Our consultants understand the supervisory expectations that apply to your sector.
POJK-aligned testing for core banking, mobile banking, and payment switching environments.
BSSN-aligned assessments for national and regional digital services and citizen data platforms.
OT/ICS and IT-OT boundary testing for Kalimantan's resource and power operators.
Core network, BSS/OSS, and subscriber platform security for carriers and ISPs.
Clinical system, EMR, and medical device assessments protecting patient data.
Continuous testing that keeps pace with high-velocity product and platform teams.
Leadership
Our leadership team came from the red teams, audit floors, and research labs of Indonesia's most regulated organisations.
RN Co-Founder & Chief Executive Officer
Fifteen years leading offensive security programmes for Indonesian tier-one banks and state enterprises. Former head of red team at a national payment provider.
AW Co-Founder & Chief Technology Officer
Vulnerability researcher with 20+ credited CVEs across enterprise network and virtualisation products. Builds the tooling behind our red team practice.
SR Co-Founder & Chief Operating Officer
Leads delivery governance, regulatory alignment, and client assurance. Previously led IT audit for a multinational mining group in Kalimantan.
Media coverage
Journalists and industry analysts cite our disclosures because we publish responsibly and explain impact clearly.
BorneoSec ungkap celah kritikal pada platform pembayaran regional
Indonesian security firms move up the offensive security value chain
Research lab in Borneo credited with 38 CVEs across enterprise software
Sektor energi Kalimantan percepat kesiapan keamanan OT
Insights
Practical guidance on Indonesian regulatory expectations, offensive tradecraft, and defensive engineering.
A practical breakdown of how Indonesian financial institutions can align penetration testing scope, frequency, and reporting with OJK expectations.
Field notes from assessing operational technology environments across mining and power generation sites, and the four boundary weaknesses we find repeatedly.
The two are routinely confused during procurement. Here is how to decide which one answers the question your board is actually asking.
Common questions
If your question isn't covered here, our engagement leads will answer it directly on an introductory call.
Standard penetration tests are typically scheduled within 10 business days of a signed statement of work. Incident response retainer clients receive same-day mobilisation.
All evidence, findings, and reports are processed and retained on Indonesian infrastructure with encryption at rest, aligned to UU PDP requirements.
Yes. Every fixed-scope engagement includes one full remediation retest within 90 days and a formal attestation letter suitable for auditors.
Our deliverables are structured for regulator submission, and our consultants routinely join audit interviews to explain findings and remediation evidence.
Start an engagement
Tell us about your environment and objectives. An engagement lead — not a sales representative — will respond within one business day with a scoped proposal.
General & new engagement enquiries
Active incident — monitored 24/7
Mon–Fri, 08:00–18:00 WITA
Jl. Ahmad Yani Km 5, Sungai Besar
Banjarbaru, Kalimantan Selatan 70714