STH Security Blog and Insights
Security Blog and Research
Technical analyses, regulatory summaries, and offensive security methodologies to help engineering teams, CISOs, and auditors build resilient systems.
-
AI-Native SDLC Security Engineering: Securing AI Coding Agent Against Poisoning and Sandbox Evasion
Risk-based coding-agent controls grounded in the Anthropic playbook and vendor documentation, covering permissions, hooks, sandboxing, review and their practical limits.
-
Thai AI Governance Framework: BOT, ETDA, NCSA Guidelines, and AI Red Teaming
BOT AI risk policy guidance, ETDA GenAI guidance and the draft EIA Playbook, plus NCSA guidance and risk-based technical assessment recommendations.
-
Thailand Digital ID Standards Guide: ETDA, DGA, IAL/AAL, and DPS Platform Security Testing
IAL, AAL and six-dimension impact matrices under ETS 11-2566, including the IAL 2.3 no-reader DOPA FVS condition, alongside DGA, electronic signatures and DPS applicability.
-
Bank of Thailand ATM Malware-Risk Guidance for Financial Institutions
A practical summary of BOT circular 1180/2559 on ATM malware-risk controls, covering short-term hardening, network segregation, cash-replenishment discipline, reconciliation, and SDMS monitoring.
-
NCSA AI Security Guidelines: Governance, Secure Lifecycle, and AI Red Teaming
Thailand NCSA guidance for trustworthy AI, organized by system lifecycle: governance and risk management, secure development and deployment, and adversarial evaluation of AI capability.
-
NDID Member Security Assessment and Penetration Testing Requirements
Security assessment expectations for NDID participants across the Requesting Party, Identity Provider, and Authoritative Source flow, including role-based penetration testing.
-
OIC IT Risk Rules and Penetration Testing for Thai Insurers
How OIC notifications expect life and non-life insurers to inventory IT assets, commission independent penetration testing of Internet-facing systems, and feed findings into a tracked risk treatment plan.
-
OWASP Top 10 Hub: Start with the Right Web, Mobile, API, LLM, or Agentic Guide
A map across all five OWASP Top 10 families, Web 2025, Mobile 2024, API 2023, LLM 2026, and Agentic 2026, with guidance on matching each series to an assessment scope.
-
NCSA CCTV and AI CCTV Security Guidelines 2026
A guide to TCSG and TCSG AI: assess system risk, select proportionate B, E and H control levels, and prepare technical acceptance and assurance evidence for CCTV deployments.
-
OWASP ASVS 5.0 Application Security Verification Standard Guide
A comprehensive guide to OWASP ASVS 5.0, detailing verification Levels 1 through 3 across all 17 security chapters and integrating verification into modern secure SDLC pipelines.
-
PCI DSS v4.0.1: VA, ASV Scanning, Pentest, and Segmentation Testing Guide
In-depth guide to Requirements 11.3 and 11.4 under PCI DSS v4.0.1, covering quarterly authenticated internal scans, external ASV scans, annual pentests, and CDE segmentation verification.
-
Google SAIF: Six Core Principles for Securing AI Systems
A breakdown of Google's Secure AI Framework and practical steps to defend models, training data, and agent integrations.
-
ISA/IEC 62443 Industrial Cybersecurity and Non-Disruptive OT Pentest Guide
An engineering guide to ISA/IEC 62443, Purdue Model segmentation, Level 3.5 Industrial DMZ defenses, and safety-first penetration testing for critical OT systems.
-
Does ISO/IEC 27001:2022 Require Penetration Testing?
Analyzing Control A.8.8 (Management of technical vulnerabilities), threat-informed prioritization with CISA KEV and EPSS, and operationalizing pentest evidence across ISMS core clauses.
-
What ISO/IEC 42001:2023 Means and How AI Pentesting Proves AIMS Readiness
An in-depth breakdown of ISO/IEC 42001:2023 for AI management systems and how offensive testing provides verifiable evidence for executive oversight and audits.
-
Understanding MITRE ATLAS for AI Red Teaming and Threat Modeling
Use MITRE ATLAS data release 2026.09, with 16 tactics, 120 techniques, and 88 sub-techniques, to select risk-based tests for generative AI, RAG, and agents.
-
NCSA Government Cloud Security Standard and Testing Guidance
National cloud security guidelines in Thailand and technical testing methodologies for public and private cloud environments.
-
NCSA Post-Quantum Cryptography Readiness Guidelines 2025: Technical Implementation
Thailand NCSA Post-Quantum Readiness guidance: Shor and Grover risks, Mosca planning, cryptographic inventories, hybrid PQC architecture, and the QKD deployment context described in the document.
-
Zero Trust: from policy decisions to enforcement
Follow the roles of the PE, PA, and PEP, and see how a policy decision controls the path to a resource.
-
NIST AI RMF Explained: Risk Management and Technical Assurance
Connect the voluntary NIST AI RMF 1.0 and AI 600-1 GenAI Profile to four functions, 12 risk categories, and context-appropriate security testing.
-
Thai SEC Security Testing Requirements for Securities and Digital Assets
Comprehensive guide to Thai SEC cybersecurity regulations, vulnerability assessments, penetration testing, digital asset custody, and smart contract audits.
-
SOC 2 Type II Penetration Testing Guide and CC7.1 Compliance
How independent penetration testing fulfills AICPA Trust Services Criteria CC7.1 during SOC 2 Type II audits, with audit window planning and auditor attestation letters.
-
SWIFT CSP CSCF v2025/v2026 Penetration Testing and Assessment Guide
A practical guide to SWIFT Customer Security Programme compliance, Control 1.1 network segmentation testing, and community-standard independent assessments.
-
MPA Content Security v5.3.1 and Penetration Testing for Media Production
An overview of MPA Content Security Best Practices v5.3.1, the TPN four-tier shield framework, and mandatory penetration testing under Control TS-4.1 for production vendors.
-
Penetration Testing Requirements under Bank of Thailand Regulations
BOT VA/pentest rules, iPentest, mobile banking and e-money controls, plus AI risk guideline Wor 5994/2568, with duties distinguished from guidance.
-
Thailand Cybersecurity Act 2019 and Critical Information Infrastructure
Duties of CII operators under Thailand's Cybersecurity Act and recommended penetration testing practices.
-
Enterprise ATT&CK v19.2: Adversary Tactics and Offensive Security Testing
Navigating the 14 tactics of Enterprise ATT&CK v19.2 to design objective-driven offensive tests and evaluate detection coverage.
-
NCSA Website Security Standard 2025 and Testing Requirements
Overview of the National Cyber Security Agency's standard for government and critical infrastructure websites in Thailand.
-
OWASP Top 10 for Agentic Applications:2026 and Agent Security
Analyzing security risks in autonomous AI agents, tool invocation, memory poisoning, and Model Context Protocol integrations.
-
OWASP API Security Top 10:2023 and Practical Mitigation
Key vulnerabilities in modern API architectures including BOLA, broken authentication, and excessive data exposure.
-
OWASP Top 10 for LLM Applications:2026 Security Guide
Comprehensive guide to securing LLM applications against prompt injection, model theft, sensitive data exposure, and supply-chain vulnerabilities.
-
OWASP Mobile Top 10:2024 for iOS and Android Security
Essential mobile application security guidelines covering credential storage, network communications, and client-side code hardening.
-
OWASP Top 10:2025 for Web Applications and Pentesting Guidelines
Detailed review of the 2025 web security risks, including broken access control, cryptographic failures, and injection attacks with mitigating controls.
-
Does Thailand's PDPA Require Penetration Testing?
Understand risk-based safeguards, breach notification, cross-border transfers, and DPO criteria, distinguishing legal duties from pentest evidence.
