# Security Blog and Research Locale: `en` Source: `/en/blog/` STH Security Blog and Insights # Security Blog and Research Technical analyses, regulatory summaries, and offensive security methodologies to help engineering teams, CISOs, and auditors build resilient systems. ![CyberSecurity Research. Illustration of a black cat cybersecurity researcher analyzing security intelligence data on a holographic display](/assets/generated/blog/sth-blog-hero.webp) Category: - Security Frameworks 6 October 2026 8 min read [AI-Native SDLC Security Engineering: Securing AI Coding Agent Against Poisoning and Sandbox Evasion](/en/compliance/ai-native-sdlc/) Risk-based coding-agent controls grounded in the Anthropic playbook and vendor documentation, covering permissions, hooks, sandboxing, review and their practical limits. AI-Native SDLC Agent Security Anthropic Sandboxing CI/CD Gate [Read full article ](/en/compliance/ai-native-sdlc/) - AI Security and Governance 6 October 2026 7 min read [Thai AI Governance Framework: BOT, ETDA, NCSA Guidelines, and AI Red Teaming](/en/compliance/thai-ai-governance/) BOT AI risk policy guidance, ETDA GenAI guidance and the draft EIA Playbook, plus NCSA guidance and risk-based technical assessment recommendations. AI Governance BOT ETDA NCSA AI Red Teaming [Read full article ](/en/compliance/thai-ai-governance/) - Banking and Compliance 6 October 2026 7 min read [Thailand Digital ID Standards Guide: ETDA, DGA, IAL/AAL, and DPS Platform Security Testing](/en/compliance/thailand-digital-id/) IAL, AAL and six-dimension impact matrices under ETS 11-2566, including the IAL 2.3 no-reader DOPA FVS condition, alongside DGA, electronic signatures and DPS applicability. ETDA Digital ID DGA DPS e-Signature [Read full article ](/en/compliance/thailand-digital-id/) - Banking and Compliance 3 October 2026 6 min read [Bank of Thailand ATM Malware-Risk Guidance for Financial Institutions](/en/compliance/bot-atm-malware-guideline/) A practical summary of BOT circular 1180/2559 on ATM malware-risk controls, covering short-term hardening, network segregation, cash-replenishment discipline, reconciliation, and SDMS monitoring. BOT ATM Security Malware Defense [Read full article ](/en/compliance/bot-atm-malware-guideline/) - AI Security and Governance 3 October 2026 7 min read [NCSA AI Security Guidelines: Governance, Secure Lifecycle, and AI Red Teaming](/en/compliance/ncsa-ai-security-guidelines/) Thailand NCSA guidance for trustworthy AI, organized by system lifecycle: governance and risk management, secure development and deployment, and adversarial evaluation of AI capability. NCSA AI Security AI Governance [Read full article ](/en/compliance/ncsa-ai-security-guidelines/) - Banking and Compliance 3 October 2026 6 min read [NDID Member Security Assessment and Penetration Testing Requirements](/en/compliance/ndid/) Security assessment expectations for NDID participants across the Requesting Party, Identity Provider, and Authoritative Source flow, including role-based penetration testing. NDID Digital Identity Member Assessment [Read full article ](/en/compliance/ndid/) - Banking and Compliance 3 October 2026 6 min read [OIC IT Risk Rules and Penetration Testing for Thai Insurers](/en/compliance/oic/) How OIC notifications expect life and non-life insurers to inventory IT assets, commission independent penetration testing of Internet-facing systems, and feed findings into a tracked risk treatment plan. OIC Insurance IT Risk Penetration Testing [Read full article ](/en/compliance/oic/) - OWASP and Application Security 3 October 2026 5 min read [OWASP Top 10 Hub: Start with the Right Web, Mobile, API, LLM, or Agentic Guide](/en/compliance/owasp-top-10/) A map across all five OWASP Top 10 families, Web 2025, Mobile 2024, API 2023, LLM 2026, and Agentic 2026, with guidance on matching each series to an assessment scope. OWASP Top 10 Web Security API Security Mobile Security LLM Security [Read full article ](/en/compliance/owasp-top-10/) - Security Frameworks 1 October 2026 8 min read [NCSA CCTV and AI CCTV Security Guidelines 2026](/en/compliance/ncsa-cctv-security-guidelines/) A guide to TCSG and TCSG AI: assess system risk, select proportionate B, E and H control levels, and prepare technical acceptance and assurance evidence for CCTV deployments. NCSA CCTV Security AI CCTV TCSG Penetration Testing [Read full article ](/en/compliance/ncsa-cctv-security-guidelines/) - OWASP and Application Security 28 September 2026 9 min read [OWASP ASVS 5.0 Application Security Verification Standard Guide](/en/compliance/owasp-asvs/) A comprehensive guide to OWASP ASVS 5.0, detailing verification Levels 1 through 3 across all 17 security chapters and integrating verification into modern secure SDLC pipelines. OWASP ASVS ASVS 5.0 Application Security Secure SDLC Pentest [Read full article ](/en/compliance/owasp-asvs/) - Banking and Compliance 24 September 2026 8 min read [PCI DSS v4.0.1: VA, ASV Scanning, Pentest, and Segmentation Testing Guide](/en/compliance/pci-dss/) In-depth guide to Requirements 11.3 and 11.4 under PCI DSS v4.0.1, covering quarterly authenticated internal scans, external ASV scans, annual pentests, and CDE segmentation verification. PCI DSS v4.0.1 ASV Scan Vulnerability Assessment Penetration Testing Segmentation [Read full article ](/en/compliance/pci-dss/) - AI Security and Governance 23 September 2026 6 min read [Google SAIF: Six Core Principles for Securing AI Systems](/en/compliance/google-saif/) A breakdown of Google's Secure AI Framework and practical steps to defend models, training data, and agent integrations. Google SAIF Secure AI Framework Agent Security [Read full article ](/en/compliance/google-saif/) - Security Frameworks 23 September 2026 8 min read [ISA/IEC 62443 Industrial Cybersecurity and Non-Disruptive OT Pentest Guide](/en/compliance/iec-62443/) An engineering guide to ISA/IEC 62443, Purdue Model segmentation, Level 3.5 Industrial DMZ defenses, and safety-first penetration testing for critical OT systems. IEC 62443 OT Security SCADA Purdue Model [Read full article ](/en/compliance/iec-62443/) - Security Frameworks 23 September 2026 7 min read [Does ISO/IEC 27001:2022 Require Penetration Testing?](/en/compliance/iso-27001/) Analyzing Control A.8.8 (Management of technical vulnerabilities), threat-informed prioritization with CISA KEV and EPSS, and operationalizing pentest evidence across ISMS core clauses. ISO/IEC 27001:2022 Annex A.8.8 Vulnerability Management ISMS [Read full article ](/en/compliance/iso-27001/) - AI Security and Governance 23 September 2026 7 min read [What ISO/IEC 42001:2023 Means and How AI Pentesting Proves AIMS Readiness](/en/compliance/iso-42001-ai-management/) An in-depth breakdown of ISO/IEC 42001:2023 for AI management systems and how offensive testing provides verifiable evidence for executive oversight and audits. ISO 42001 AI Pentest AIMS AI Red Teaming [Read full article ](/en/compliance/iso-42001-ai-management/) - AI Security and Governance 23 September 2026 8 min read [Understanding MITRE ATLAS for AI Red Teaming and Threat Modeling](/en/compliance/mitre-atlas/) Use MITRE ATLAS data release 2026.09, with 16 tactics, 120 techniques, and 88 sub-techniques, to select risk-based tests for generative AI, RAG, and agents. MITRE ATLAS Adversarial AI Prompt Injection AI Red Team [Read full article ](/en/compliance/mitre-atlas/) - Security Frameworks 23 September 2026 6 min read [NCSA Government Cloud Security Standard and Testing Guidance](/en/compliance/ncsa-cloud-security-standard/) National cloud security guidelines in Thailand and technical testing methodologies for public and private cloud environments. NCSA Cloud Cloud Security Shared Responsibility [Read full article ](/en/compliance/ncsa-cloud-security-standard/) - Security Frameworks 23 September 2026 7 min read [NCSA Post-Quantum Cryptography Readiness Guidelines 2025: Technical Implementation](/en/compliance/ncsa-post-quantum-readiness/) Thailand NCSA Post-Quantum Readiness guidance: Shor and Grover risks, Mosca planning, cryptographic inventories, hybrid PQC architecture, and the QKD deployment context described in the document. NCSA PQC Post-Quantum Crypto Agility NIST PQC [Read full article ](/en/compliance/ncsa-post-quantum-readiness/) - Security Frameworks 23 September 2026 7 min read [Zero Trust: from policy decisions to enforcement](/en/compliance/ncsa-zero-trust-guidelines/) Follow the roles of the PE, PA, and PEP, and see how a policy decision controls the path to a resource. Zero Trust Policy Engine Access Control [Read full article ](/en/compliance/ncsa-zero-trust-guidelines/) - AI Security and Governance 23 September 2026 6 min read [NIST AI RMF Explained: Risk Management and Technical Assurance](/en/compliance/nist-ai-rmf/) Connect the voluntary NIST AI RMF 1.0 and AI 600-1 GenAI Profile to four functions, 12 risk categories, and context-appropriate security testing. NIST AI RMF Govern-Map-Measure-Manage AI Trustworthiness [Read full article ](/en/compliance/nist-ai-rmf/) - Banking and Compliance 23 September 2026 7 min read [Thai SEC Security Testing Requirements for Securities and Digital Assets](/en/compliance/sec/) Comprehensive guide to Thai SEC cybersecurity regulations, vulnerability assessments, penetration testing, digital asset custody, and smart contract audits. Thai SEC Digital Asset Securities IT Risk [Read full article ](/en/compliance/sec/) - Security Frameworks 23 September 2026 8 min read [SOC 2 Type II Penetration Testing Guide and CC7.1 Compliance](/en/compliance/soc-2/) How independent penetration testing fulfills AICPA Trust Services Criteria CC7.1 during SOC 2 Type II audits, with audit window planning and auditor attestation letters. SOC 2 Type II Trust Services Criteria CC7.1 Pentest [Read full article ](/en/compliance/soc-2/) - Banking and Compliance 23 September 2026 7 min read [SWIFT CSP CSCF v2025/v2026 Penetration Testing and Assessment Guide](/en/compliance/swift-csp/) A practical guide to SWIFT Customer Security Programme compliance, Control 1.1 network segmentation testing, and community-standard independent assessments. SWIFT CSP CSCF v2025 Banking Segmentation Test [Read full article ](/en/compliance/swift-csp/) - Security Frameworks 3 September 2026 7 min read [MPA Content Security v5.3.1 and Penetration Testing for Media Production](/en/compliance/mpa-content-security/) An overview of MPA Content Security Best Practices v5.3.1, the TPN four-tier shield framework, and mandatory penetration testing under Control TS-4.1 for production vendors. MPA v5.3.1 TPN Shield Content Security Penetration Testing [Read full article ](/en/compliance/mpa-content-security/) - Banking and Compliance 22 August 2026 6 min read [Penetration Testing Requirements under Bank of Thailand Regulations](/en/compliance/bank-of-thailand/) BOT VA/pentest rules, iPentest, mobile banking and e-money controls, plus AI risk guideline Wor 5994/2568, with duties distinguished from guidance. BOT iPentest Mobile Banking Financial Security [Read full article ](/en/compliance/bank-of-thailand/) - Banking and Compliance 22 August 2026 5 min read [Thailand Cybersecurity Act 2019 and Critical Information Infrastructure](/en/compliance/cybersecurity-act/) Duties of CII operators under Thailand's Cybersecurity Act and recommended penetration testing practices. Cybersecurity Act CII Critical Infrastructure [Read full article ](/en/compliance/cybersecurity-act/) - Security Frameworks 22 August 2026 8 min read [Enterprise ATT&CK v19.2: Adversary Tactics and Offensive Security Testing](/en/compliance/mitre-attack/) Navigating the 14 tactics of Enterprise ATT&CK v19.2 to design objective-driven offensive tests and evaluate detection coverage. MITRE ATT&CK v19.2 Enterprise Matrix Adversary Emulation [Read full article ](/en/compliance/mitre-attack/) - Banking and Compliance 22 August 2026 6 min read [NCSA Website Security Standard 2025 and Testing Requirements](/en/compliance/ncsa-website-standard/) Overview of the National Cyber Security Agency's standard for government and critical infrastructure websites in Thailand. NCSA Website Standard 2568 Government Security [Read full article ](/en/compliance/ncsa-website-standard/) - OWASP and Application Security 22 August 2026 8 min read [OWASP Top 10 for Agentic Applications:2026 and Agent Security](/en/compliance/owasp-top-10/agent/) Analyzing security risks in autonomous AI agents, tool invocation, memory poisoning, and Model Context Protocol integrations. OWASP Agentic:2026 AI Agents Tool Calling MCP Security [Read full article ](/en/compliance/owasp-top-10/agent/) - OWASP and Application Security 22 August 2026 7 min read [OWASP API Security Top 10:2023 and Practical Mitigation](/en/compliance/owasp-top-10/api/) Key vulnerabilities in modern API architectures including BOLA, broken authentication, and excessive data exposure. OWASP API:2023 BOLA BFLA API Security [Read full article ](/en/compliance/owasp-top-10/api/) - OWASP and Application Security 22 August 2026 8 min read [OWASP Top 10 for LLM Applications:2026 Security Guide](/en/compliance/owasp-top-10/llm/) Comprehensive guide to securing LLM applications against prompt injection, model theft, sensitive data exposure, and supply-chain vulnerabilities. OWASP LLM:2026 Generative AI Prompt Injection Data Poisoning [Read full article ](/en/compliance/owasp-top-10/llm/) - OWASP and Application Security 22 August 2026 7 min read [OWASP Mobile Top 10:2024 for iOS and Android Security](/en/compliance/owasp-top-10/mobile/) Essential mobile application security guidelines covering credential storage, network communications, and client-side code hardening. OWASP Mobile:2024 iOS Security Android Security App Hardening [Read full article ](/en/compliance/owasp-top-10/mobile/) - OWASP and Application Security 22 August 2026 9 min read [OWASP Top 10:2025 for Web Applications and Pentesting Guidelines](/en/compliance/owasp-top-10/web/) Detailed review of the 2025 web security risks, including broken access control, cryptographic failures, and injection attacks with mitigating controls. OWASP Top 10:2025 Web Security Broken Access Control Injection [Read full article ](/en/compliance/owasp-top-10/web/) - Banking and Compliance 22 August 2026 5 min read [Does Thailand's PDPA Require Penetration Testing?](/en/compliance/pdpa/) Understand risk-based safeguards, breach notification, cross-border transfers, and DPO criteria, distinguishing legal duties from pentest evidence. PDPA Data Protection Security Measures [Read full article ](/en/compliance/pdpa/) ## Need a pentest aligned with regulatory requirements and international standards? Tell us about your systems and required standards. The STH team will propose a suitable testing approach and quotation [Request a Pentest quote](/en/#contact) Last updated 13 October 2026