# Professional penetration testing with the power of STH experts and AI Locale: `en` Source: `/en/` Summary: Expert-led Penetration Testing (Pentest) and Vulnerability Assessment in Thailand, guided by OWASP, with verifiable PoC evidence and remediation support. ![Japanese-style illustration of a young black-cat hacker testing a system on a MacBook Pro with an official Siam Thanat Hack sticker](/assets/generated/sth-cat-hero-young-macbook-v4.webp) Human-Led AI-Augmented # Professional penetration testing with the power of STH experts and AI Penetration testing services for Web, Mobile, API, and Network with verifiable evidence and actionable remediation guidance Siam Thanat Hack certifications [ ![First page of the Siam Thanat Hack ISO/IEC 27001:2022 certificate](/assets/certificates/sth-iso-iec-27001-2022-page-1.webp) ](/assets/documents/sth-iso-iec-27001-2022-certificate.pdf) ![ISO/IEC 27001:2022 Information Security Management Systems](/assets/brand/iso-iec-27001-2022.png) [ ![First page of the Siam Thanat Hack ISO 9001:2015 certificate](/assets/certificates/sth-iso-9001-2015-page-1.webp) ](/assets/documents/sth-iso-9001-2015-certificate.pdf) ![ISO 9001:2015 Quality Management Systems](/assets/brand/iso-9001-2015.png) [ ![CREST Pathway Plus](/assets/brand/crest-pathway-plus.png) ](https://www.crest-approved.org/membership/pathway-plus-organisations/#:~:text=Siam%20Thanat%20Hack) [ Request a pentest quote ](/en/#contact) [ Explore our services ](https://www.youtube.com/watch?v=Tnx4HXRj-_o) [ Scroll to explore ](/en/#services) OFFENSIVE SECURITY / 01 ## Our services Find exploitable vulnerabilities with evidence and practical remediation. 01 / WEB APPLICATION PENETRATION TESTING ### Go deeper than the OWASP Top 10 Test web applications for exploitable vulnerabilities, including business logic flaws scanners miss. #### Coverage - OWASP Top 10 and OWASP ASVS - Authentication, sessions, and authorization - IDOR, injection, SSRF, and business logic #### What you receive Executive and technical reports with evidence, reproduction steps, impact, remediation, and scoped retesting. 02 / MOBILE APPLICATION PENETRATION TESTING ### Covering both mobile applications and connected backend services Test both the app and backend/API against the OWASP Mobile Top 10 to find exploitable vulnerabilities. #### Coverage - On-device storage and encryption - TLS, certificate pinning, and sessions/tokens - Reverse engineering, tampering, and business logic #### What you receive Reporting and recommendations for both application and backend, a results briefing, and retesting within the agreed scope. 03 / API PENETRATION TESTING ### Test every endpoint and chain realistic attack paths Find authentication, authorization, rate-limiting, and data-exposure vulnerabilities in REST and GraphQL APIs. #### Coverage - REST, GraphQL, and tokens/sessions - BOLA/IDOR, rate limits, and abuse - Mass assignment, data exposure, and business logic #### What you receive Endpoint-level reporting with evidence, reproduction steps, impact, and developer-ready recommendations. 04 / NETWORK PENETRATION TESTING ### Validate attack paths from the perimeter to critical systems Test external and internal networks within the mutually agreed scope and Rules of Engagement. #### Coverage - Internet-facing services and VPN gateways - Internal networks, lateral movement, and Active Directory - Misconfiguration, privilege escalation, and segmentation #### What you receive Executive and technical reporting with network-segmentation evidence and scoped retesting. 05 / SECURE CODE REVIEW ### Inspect logic beyond the reach of black-box tests and scanners Manually analyze source code for vulnerabilities and logic flaws with practical remediation. #### Coverage - Code-level authentication and authorization - Input validation, injection, and deserialization - Secrets, encryption, dependencies, and framework configuration #### What you receive Reporting with file/line locations, impact, fixes, and architectural guidance where needed. 06 / VULNERABILITY RESEARCH ### Go deep into binaries, protocols, and exploitability Research binaries, protocols, or codebases that require more than conventional checklist testing. #### Coverage - Analyze specialized binaries, protocols, or codebases - Fuzzing, reverse engineering, and proof of concept - Assess impact and produce an advisory #### What you receive An advisory with proof of concept, risk prioritization, impact, and mitigation guidance. Humans define scope and validate every finding. Within the authorized scope, AI runs automated active testing to increase speed, coverage, and efficiency against techniques real attackers may use. ASSESSMENT GUIDE ## VA Scan, Pentest and Red Team: which assessment do you need? Each assessment answers a different question. Choose according to the objective, scope, and evidence you need; they are not automatic substitutes for one another. ![Diagram comparing VA Scan, Pentest, and Red Team with an expert cat and AI robot for each assessment type](/assets/generated/sth-assessment-guide-diagram.webp) 01 / VA SCAN ### VA Scan / Vulnerability Assessment Broadly discover and prioritize vulnerabilities. Scanner-only VA does not replace a Pentest. **Choose it when:** You need an initial assessment of a large network environment, broad visibility of many vulnerabilities, and a plan for deeper validation. 02 / PENTEST ### Pentest / Penetration Testing Experts use manual testing to validate exploitability and impact within the agreed scope. **Choose it when:** You need evidence that vulnerabilities are exploitable and remediation guidance for critical Web and Mobile applications. 03 / RED TEAM ### Red Team Simulate objective- and threat-led scenarios under explicit Scope and Rules of Engagement to assess prevention, detection, and response objectives. **Choose it when:** You already run VA and Pentest regularly and need to test how people, processes, and technology respond to a defined scenario. Scroll horizontally to view every column | VA Scan | Pentest | Red Team | | --- | --- | --- | |





Coverage

| | | | | | \* Targets the stated objective, such as taking over a Domain Controller or implanting a backdoor while evading SOC detection, rather than seeking the greatest possible number of vulnerabilities. | |





Exploit proof

| | | | | \* Excludes vulnerabilities that could affect business continuity. | | |





Real-world simulation

| | | | | \* Testing focuses on non-production systems to reduce impact. | \* Focuses on testing detection and response processes. | [Explore more articles and guides ](/en/blog/) ABOUT STH / 02 ## About![STH](/assets/brand/sth-title-logo.webp) STH is a Thai white-hat team in Bangkok, combining deep expertise, operational discipline, and auditable communication. Incorporated on 11 December 2018 with registered headquarters in Don Mueang and operational office near MRT Phra Ram 9, Bangkok. Operating for **7** years ![The STH team receives the Thailand Cyber Top Talent 2023 winner award with faces concealed by cat graphics](/assets/about/sth-slide-6.webp) ### Competition-proven experience STH received the winner award at Thailand Cyber Top Talent 2023 ![The STH team and application-security workshop participants in an SCBX meeting room with faces concealed by cat graphics](/assets/about/sth-slide-7.webp) ### Sharing application-security experience A hands-on workshop with the SCBX technology team ![A mobile-application security workshop at Krungthai Bank with faces concealed by cat graphics](/assets/about/sth-slide-8.webp) ### Hands-on mobile security Practice analyzing applications, devices, and security behavior together ![NCSA CTF Bootcamp participants with the STH team, with faces concealed by cat graphics](/assets/about/sth-slide-9.webp) ### Building challenges and sharing knowledge Contributing to a CTF bootcamp that advances cybersecurity skills ![Team wowzaa receives the Splunk BOTS championship award with faces concealed by cat graphics](/assets/about/sth-slide-10.jpg) ### Splunk BOTS champion Threat analysis and response skills proven through competition ![The STH team during Hack the Scammer CTF 2025 with faces concealed by cat graphics](/assets/about/sth-slide-11.jpg) ### Designing the Hack The Scammer competition Applying penetration-testing expertise to design a competition platform that supports the fight against cybercrime ![A mobile-application fingerprint test screen with source code in the background](/assets/about/sth-slide-1.webp) ### Mobile Security Lab Use the BOT Notification 4/2568 control baseline for the Mobile Application, API/backend, authentication, and transaction flow; where biometrics are used, assess PAD/liveness and biometric-data protection [Open BOT Notification 4/2568 ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2568/ThaiPDF/25680027.pdf) ![Multiple iPhones in STH's mobile-application security test fleet](/assets/about/sth-slide-2.webp) ### A multi-device test fleet Validate application behavior across diverse devices and operating systems ![An STH specialist presents on passkeys at CyberSec Asia and Thailand International Cyber Week 2025](/assets/about/sth-slide-12.jpg) ### Sharing knowledge on the cybersecurity stage CyberSec Asia × Thailand International Cyber Week 2025 ![The STH team demonstrates face replicas for Presentation Attack Detection (PAD) testing](/assets/about/sth-slide-3.jpg) ### Presentation Attack Detection (PAD) PAD testing under the Bank of Thailand's biometric authentication guidance [Biometric Technology guideline, B.E. 2566 (2023)Guideline B.E. 2566 ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FPG/2566/ThaiPDF/25660181.pdf) [Biometric Technology guideline, B.E. 2563 (2020)Guideline B.E. 2563 ](https://www.bot.or.th/Thai/FIPCS/Documents/FOG/2563/ThaiPDF/25630177.pdf) 01 ### Roots in knowledge sharing STH grew from knowledge sharing. Former operators of the Facebook page **Longhackz** then expanded into CTF competitions, challenge creation, vulnerability research, and high-difficulty technical advisory work. ![Logo of the Longhackz Thai cybersecurity Facebook page](/assets/about/longhackz-logo.webp) 02 ### Experience with critical systems Our specialists have worked on critical systems for banks, payment gateways, and leading organizations. We work strictly within an authorized scope and Rules of Engagement. We do not perform unauthorized access, account hacking, or account recovery. 03 ### Human-Led, AI-Augmented Humans define scope and validate every finding. Within the authorized scope, AI runs automated active testing to increase speed, coverage, and efficiency against techniques real attackers may use. Within the authorized scope, we use AI for reconnaissance and automated attack testing to explore the attack surface and test hypotheses faster. Specialists define scope, control testing, reproduce findings, assess impact, and approve the final report. ### Professional certifications represented across the team - - - - - - - - - - - - Passionate about offensive security and eager to grow with our team? [Explore our open positions ](/en/careers/) HUMAN-LED × AI-AUGMENTED / 03 ## We test your systems from start to finish Experts define scope, control testing, and validate results while AI runs automated active testing within scope to increase speed and coverage. ![Human pentester, target system on phone and computer, and robotic-cat AI agent](/assets/generated/sth-human-ai-method-v2.webp) Human owns the decision ### Experts lead every step from scope to sign-off - Define scope, Rules of Engagement, and the test window - Model threats and find abuse cases scanners cannot see - Manually exploit and assemble attack chains - Assess impact, risk, and remediation before reporting Evidence from the real surface ### Test real system behavior, not just a checklist - Web, mobile, API, and network testing within the agreed scope - Assess access control, sessions, data exposure, and business logic - Capture reproducible evidence with clear impact explanations - Deliver remediation guidance development teams can apply AI tests actively; humans retain authority ### AI runs automated active testing; humans validate every finding - Perform reconnaissance and automated attack testing within the authorized scope - Build an evidence index and check coverage consistency - Assist with report drafting while every final report receives human review - An AI hypothesis never becomes a finding until a human reproduces it **MANUAL VALIDATION GATE** Every finding must be reproducible, evidenced, and manually validated DELIVERY FLOW / 04 ## Our delivery process Every phase has a clear owner, evidence, and decision gate. Phase 01 details ### Plan Turn business objectives into a clear, safe, and authorized testing scope before work begins. **Owner** Engagement Lead **Estimated duration** 1-2 business days #### What we do - Confirm in-scope and out-of-scope systems, domains, IP addresses, APIs, and applications - Prepare test accounts, access rights, MFA, and test data - Define the test window, Rules of Engagement, and stop conditions - Define communication channels and escalation procedures for critical events #### Deliverables - Approved Scope & Rules of Engagement - Asset and Account Matrix - Test Schedule - Communication and Escalation Plan #### Evidence - Testing authorization letter - System and endpoint inventory - Access Readiness Checklist - Contacts and approvers #### Framework Mapping Engagement GovernanceOWASP WSTG v4.2Authorized Testing **Decision Gate** Begin testing only after scope, access, the test window, and ROE are fully confirmed. [View scope and ROE ](/en/#contact) Phase 02 details ### Analyze Build a threat model and attack-surface map to prioritize likely, high-impact attack paths. **Owner** Lead Pentester / Security Analyst **Estimated duration** 1-3 business days #### What we do - Analyze architecture, trust boundaries, and data flows - Build a threat model and abuse cases - Map the attack surface and exposed technologies - Analyze roles, privileges, and paths to sensitive data - Prioritize test scenarios by risk and impact #### Deliverables - Attack Surface Map - Threat Model and Abuse Cases - Prioritized Test Scenarios - Initial Attack Hypotheses #### Evidence - Endpoint and service inventory - Role and Privilege Matrix - Data flows and trust boundaries - Reconnaissance Artifacts #### Framework Mapping MITRE ATT&CK v19.2ReconnaissanceResource development - when authorized and in scopeOWASP WSTG: Information Gathering **Decision Gate** Confirm the high-value assets, trust boundaries, and attack paths to test. [View attack surface ](https://wstg.owasp.org/v4.2/) Phase 03 details ### Test Perform authorized manual offensive testing to validate vulnerabilities and connect them into attack chains. **Owner** Technical Lead / Pentest Team **Estimated duration** 5-15 business days #### What we do - Test authentication, authorization, and session management - Analyze business logic and workflow bypasses - Validate vulnerabilities through manual exploitation - Connect multiple vulnerabilities to assess attack-chain impact - Keep testing within the Rules of Engagement #### Deliverables - Verified Security Findings - Proof of Concept - Attack Chain Diagram - Test Coverage Matrix #### Evidence - HTTP Requests and Responses - Screenshots and Screen Recordings - Commands, Logs and Tool Output - PoC code and impact evidence #### Framework Mapping OWASP Top 10:2025OWASP WSTG v4.2 Test IDsMITRE ATT&CK v19.2 Tactics & TechniquesOnly tested and validated behavior **Decision Gate** A vulnerability must be reproducible, sufficiently evidenced, and tied to system or business impact. [View coverage and evidence ](/en/#contact) Phase 04 details ### Validate Recheck results to remove false positives, define affected scope, and assess risk from proven evidence. **Owner** Validation Lead / QA Reviewer **Estimated duration** 1-3 business days #### What we do - Reproduce vulnerabilities under controlled conditions - Review attack preconditions and constraints - Use negative controls to distinguish expected behavior from vulnerabilities - Assess impact on confidentiality, integrity, and availability - Analyze business impact and real-world exploitability #### Deliverables - Validated Findings - Affected Asset and Scope - Impact Analysis - Risk Rating and Rationale - Remediation Priority #### Evidence - Reproduction Steps - Successful and Failed Test Cases - Privilege or data impact - Preconditions and Environmental Context #### Framework Mapping OWASP Top 10:2025 CategoryOWASP WSTG Test ReferenceMITRE ATT&CK Technique MappingImpact & Risk Validation **Decision Gate** Classify results as Confirmed, Informational, or Rejected with traceable rationale. [View risk rationale ](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology) Phase 05 details ### Report Turn test results into prioritized, actionable information for executives and technical teams. **Owner** Report Owner / QA Reviewer **Estimated duration** 3-5 business days #### What we do - Summarize the overall risk and business impact - Document technical details and reproduction steps - Show attack paths and relationships between vulnerabilities - Recommend immediate and long-term remediation - Quality-review and remove unnecessary sensitive data from evidence #### Deliverables - Executive Report - Technical Pentest Report - Finding and Evidence Register - Attack Chain Visualization - Prioritized Remediation Plan #### Evidence - Sanitized Screenshots - Request and Response References - PoC and Reproduction Steps - Evidence Traceability Index #### Framework Mapping OWASP Top 10:2025 CoverageOWASP WSTG Test CoverageMITRE ATT&CK Attack PathFinding-to-Framework Matrix **Decision Gate** Confirm facts, remediation owners, priorities, and items requiring retesting. [View report sample ](/en/#contact) Phase 06 details ### Retest Retest under the original conditions, check related bypasses or variants, and verify that risk is genuinely reduced. **Owner** Original Tester / QA Reviewer **Estimated duration** 1-3 business days #### What we do - Repeat the original PoC and test steps - Verify the root cause, not only the visible symptom - Test related variants and bypass paths - Check the fix for impact on existing functionality - Compare evidence before and after remediation #### Deliverables - Retest Report - Finding Status Update - Closure Evidence - Residual Risk Summary - Outstanding vulnerability list #### Evidence - Before and After Requests - Updated configuration or application version - Retest Screenshots - Timestamped Verification Results #### Framework Mapping Original OWASP Reference RetainedOriginal ATT&CK Mapping RetainedFix VerificationClosure Traceability **Decision Gate** Confirm each post-retest status with evidence as Closed, Partially Remediated, Open, Unable to Verify, or Risk Accepted. Timelines are estimates and may change with scope, access, and Rules of Engagement. **Governance & Compliance** ### Standards & Testing Frameworks ### General & National Cybersecurity ### Banking & Payment Systems (BOT) ### Securities & Digital Assets (SEC) and Insurance (OIC) ### All regulations and standards guides Penetration-testing requirements from Thai regulators and international standards, grouped by sector #### Financial Services, Banking & Insurance Standards - [Penetration testing under Bank of Thailand requirements](/en/compliance/bank-of-thailand/) - [Penetration testing under Thai SEC requirements](/en/compliance/sec/) - [Bank of Thailand Guidance for Mitigating ATM Malware Risk](/en/compliance/bot-atm-malware-guideline/) - [Penetration Testing Requirements for NDID Members](/en/compliance/ndid/) - [Office of Insurance Commission (OIC)](/en/compliance/oic/) - [PCI DSS v4.0.1: VA, ASV Scans, Pentest and Segmentation Testing](/en/compliance/pci-dss/) - [SWIFT CSP / CSCF v2025/v2026: KYC-SA Assessment and Penetration Testing Guide](/en/compliance/swift-csp/) #### NCSA Government Standards & Thai Cyber Laws - [Personal Data Protection Act B.E. 2562 (2019) and Penetration Testing](/en/compliance/pdpa/) - [Cybersecurity Act B.E. 2562 (2019) and Penetration Testing](/en/compliance/cybersecurity-act/) - [NCSA Website Security Standard B.E. 2568](/en/compliance/ncsa-website-standard/) - [NCSA Cloud Security Standard B.E. 2567 (2024)](/en/compliance/ncsa-cloud-security-standard/) - [NCSA AI Security Guidelines: lifecycle and governance](/en/compliance/ncsa-ai-security-guidelines/) - [NCSA Zero Trust Guidelines](/en/compliance/ncsa-zero-trust-guidelines/) - [NCSA Guidelines for Post-Quantum Readiness](/en/compliance/ncsa-post-quantum-readiness/) - [NCSA CCTV and AI CCTV Security Guidelines 2026](/en/compliance/ncsa-cctv-security-guidelines/) - [Thailand Digital ID Framework: ETDA, DGA Standards, IAL/AAL Assurance, and Platform Security Verification](/en/compliance/thailand-digital-id/) #### AI Governance and AI Security Frameworks - [What ISO/IEC 42001:2023 means and how AI pentesting proves AIMS readiness](/en/compliance/iso-42001-ai-management/) - [What NIST AI Risk Management Framework 1.0 is and how to turn GenAI risk into a test plan](/en/compliance/nist-ai-rmf/) - [What MITRE ATLAS is and how to build an AI red-team plan from it](/en/compliance/mitre-atlas/) - [What Google Secure AI Framework 2.0 is and how it secures AI agents](/en/compliance/google-saif/) - [Thai AI Governance Framework: BOT, ETDA, NCSA Guidelines and Technical AI Security Testing](/en/compliance/thai-ai-governance/) - [AI-Native SDLC Security Engineering: Securing AI Coding Agents Against Poisoning and Sandbox Evasion](/en/compliance/ai-native-sdlc/) #### Global Technical Frameworks & Security Standards - [OWASP Top 10 guides for Web, Mobile, API, LLM, and Agentic](/en/compliance/owasp-top-10/) - [OWASP ASVS 5.0 Application Security Verification Standard Guide](/en/compliance/owasp-asvs/) - [Penetration Testing under ISO/IEC 27001:2022 Requirements](/en/compliance/iso-27001/) - [MITRE ATT&CK v19.2: every Enterprise tactic for pentesting and red teaming](/en/compliance/mitre-attack/) - [MPA Content Security v5.3.1 and Penetration Testing Requirements](/en/compliance/mpa-content-security/) - [SOC 2 Type II Penetration Testing and Trust Services Criteria Guide](/en/compliance/soc-2/) - [IEC 62443 Industrial Cybersecurity and Non-Disruptive OT Pentest Guide](/en/compliance/iec-62443/) [Open the full standards hub ](/en/compliance/) VERIFIABLE TRUST / 05 ## Verifiable standards Download our certificates and review the principles behind our delivery. [ ![First page of the Siam Thanat Hack ISO/IEC 27001:2022 certificate](/assets/certificates/sth-iso-iec-27001-2022-page-1.webp) **ISO/IEC 27001:2022** Open the full certificate ](/assets/documents/sth-iso-iec-27001-2022-certificate.pdf) [ ![First page of the Siam Thanat Hack ISO 9001:2015 certificate](/assets/certificates/sth-iso-9001-2015-page-1.webp) **ISO 9001:2015** Open the full certificate ](/assets/documents/sth-iso-9001-2015-certificate.pdf) ADDITIONAL RECOGNITION ### Additional certifications and awards [ ![First page of the Siam Thanat Hack Thai company certificate](/assets/certificates/sth-company-certificate-th-page-1.webp) **Company certificate** Thai and English ](/assets/documents/sth-company-certificate-th.pdf) [ ![Siam Thanat Hack head office VAT registration (PP.20)](/assets/certificates/sth-vat-registration-head-office-page-1.webp) **VAT registration (PP.20)** Head office and Branch 1 ](/assets/documents/sth-vat-registration-head-office.pdf) [ ![Siam Thanat Hack SME registration certificate for government procurement](/assets/certificates/sth-sme-gp-registration-page-1.webp) **SME-GP registration** Government procurement ](/assets/documents/sth-sme-gp-registration.pdf) [ ![First page of the Siam Thanat Hack consultant registration certificate](/assets/certificates/sth-certificate-of-consultant-page-1.webp) **Consultant registration** Ministry of Finance ](/assets/documents/sth-certificate-of-consultant.pdf) [ ![Prime Minister Awards Thailand Cybersecurity Excellence Award 2024 certificate](/assets/certificates/sth-prime-minister-awards-2024-page-1.webp) **Prime Minister Awards 2024** Contribution Award ](/assets/documents/sth-prime-minister-awards-2024.pdf) [ ![Prime Minister Awards Thailand Cybersecurity Excellence Awards 2025 certificate](/assets/certificates/sth-prime-minister-awards-2025-page-1.webp) **Prime Minister Awards 2025** Best Performance Awards ](/assets/documents/sth-prime-minister-awards-2025.pdf) 01 ### Human validation Every finding is reproduced and manually validated 02 ### Evidence ready Evidence, reproduction steps, impact, and remediation are included 03 ### Responsible AI AI is an automated testing layer; humans decide the test results 04 ### Retest closure Verify remediation and deliver evidence according to the package or scope START THE CONVERSATION / 06 ## When you need a pentest, work with specialists. Send us your initial system details, testing scope, and preferred timeframe so we can prepare an assessment plan. [ **Email STH** pentest@sth.sh Open your email app to send project details ](mailto:pentest@sth.sh) [ **Add STH on LINE** @siamthanathack Open LINE or scan the QR code ![QR code to add LINE @siamthanathack](/assets/generated/contact/line-add-friend-qr.png) ](https://line.me/R/ti/p/@siamthanathack) PENTEST FAQ / 07 ## Frequently asked questions about our Pentest services Answers about scope, pricing, timelines, and regulatory requirements. If you cannot find what you need, talk to the team directly. ### What is the difference between a Pentest and a VA Scan, and where should we start? A VA Scan uses tools to discover vulnerabilities across a wide scope, which suits health-checking many systems and prioritizing risk first. A Pentest is hands-on testing by specialists to prove whether vulnerabilities are actually exploitable, with evidence and remediation guidance. Systems that are business-critical or hold customer data should get a Pentest alongside periodic VA, as one does not replace the other. ### What expertise and certifications does the testing team hold? The STH team has hands-on experience testing the applications of leading financial institutions and holds internationally recognized certifications at both the organizational level and the level of the individual specialists who run the tests, and were champions of Thailand Cyber Top Talent 2023. We support your engagement from start to finish: advising at the outset, preparing before testing, communicating vulnerabilities as they are found, and giving careful guidance on closing them. ### Is the testing done by real people, or just an automated scanner? Our work is human-led. Specialists define the scope, do the actual exploitation, and manually validate every finding before it reaches the report. We use AI and automated tools to speed up reconnaissance and widen coverage within the authorized scope, but the work a scanner cannot do, including chaining vulnerabilities into a real attack and testing business logic, IDOR, and authentication, stays with our experts. You get proof of real, exploitable impact with false positives already removed, not a ready-made scanner report. ### How is Pentest pricing calculated? Pricing follows the scope: how many systems, the size of each application, the number of functions or API endpoints to test, and the testing model (black-box, gray-box, or white-box). Send us your system details and the team will estimate the effort in man-days and issue a quotation with a clearly defined scope before any work begins. ### How long does testing one system take? It depends on the system's size and complexity. A single application typically takes about one to three weeks including reporting. After your team fixes the findings, we schedule a retest round to confirm the remediation. ### What do we receive when testing is complete? A full report with an executive summary and technical detail. Every finding includes reproduction steps, evidence, a CVSS-based risk rating, and practical remediation guidance. You also get direct access to the testers for questions, and a retest report after fixes. ### Do regulators require penetration testing? Several industries have direct requirements, including financial institutions under Bank of Thailand rules, securities and digital asset businesses under the Thai SEC, and card systems under PCI DSS. PDPA and the Cybersecurity Act define risk-based security duties instead. Some cite OWASP guidance directly, such as clause 6.2.2 of the Website Security Standard B.E. 2568 and Bank of Thailand notification SorNorChor 1/2564. We summarize each authority's requirements, with links to the source documents, at [Regulations & standards](/en/compliance/) ### What do we need to prepare before testing starts? Mainly, help us define the scope: the list of systems, URLs or app builds, test accounts for each user role, and the time window that suits you. We then prepare the scope and Rules of Engagement document for written sign-off before work begins. ### How safe is our data during the engagement? All testing happens within a written, authorized scope under a non-disclosure agreement. STH is certified to ISO/IEC 27001:2022 and ISO 9001:2015, which govern how evidence is handled, stored, and delivered throughout the project. ## Governance, Methodology & Certifications Reference STH BRAND ASSETS ## Download STH logos Choose the version that fits your background and download the original PNG. ![Black Siam Thanat Hack logo](/assets/brand/sth-full-black-logo.png) ### Full Black Logo For white or light backgrounds [Download PNG ](/assets/brand/sth-full-black-logo.png) ![Green and black Siam Thanat Hack logo](/assets/brand/sth-full-logo.png) ### Full Color Logo Primary color version for light backgrounds [Download PNG ](/assets/brand/sth-full-logo.png) ![White Siam Thanat Hack logo](/assets/brand/sth-logo-white.png) ### White Logo For black or dark backgrounds [Download PNG ](/assets/brand/sth-logo-white.png) ![Black STH logo](/assets/brand/sth-logo.png) ### Black Logo For white or light backgrounds [Download PNG ](/assets/brand/sth-logo.png) --- CERTIFICATE / PDF PREVIEW ## ISO/IEC 27001:2022 Siam Thanat Hack Information Security Management System certificate [Download ](/assets/documents/sth-iso-iec-27001-2022-certificate.pdf) --- CERTIFICATE / PDF PREVIEW ## ISO 9001:2015 Siam Thanat Hack Quality Management System certificate [Download ](/assets/documents/sth-iso-9001-2015-certificate.pdf) --- EC-Council ## CEH Certified Ethical Hacker ### Issuer credibility EC-Council is a cybersecurity training and professional-certification organization. ### Demonstrated capability Ethical-hacking knowledge across threats, attack vectors, detection, prevention, and assessment methodology. ### Customer value Supports broad threat coverage within a clearly authorized and ethical testing process. [View official CEH exam information ](https://www.eccouncil.org/train-certify/about-the-ceh-exam/) --- ISC2 ## CISSP Certified Information Systems Security Professional ### Issuer credibility ISC2 is a nonprofit member association for cybersecurity professionals. ### Demonstrated capability Risk management, security architecture, IAM, assessment, operations, and secure development. ### Customer value Helps connect technical findings with business risk, remediation ownership, and security governance. [View official CISSP information ](https://www.isc2.org/certifications/cissp) --- CREST ## CREST CPSA CREST Practitioner Security Analyst ### Issuer credibility CREST is an international not-for-profit membership body that accredits cybersecurity organizations and certifies professionals. ### Demonstrated capability Testing lifecycle, scoping, Windows, Unix, network services, web technologies, and vulnerability assessment. ### Customer value Supports consistent scoping, execution, and interpretation of security tests. [View official CREST CPSA information ](https://www.crest-approved.org/skills-certifications-careers/crest-practitioner-security-analyst/) --- CREST ## CREST CRT CREST Registered Penetration Tester ### Issuer credibility CREST is an international not-for-profit membership body that accredits cybersecurity organizations and certifies professionals. ### Demonstrated capability Infrastructure and web testing, operating systems, network services, scan interpretation, and vulnerability validation. ### Customer value Supports technically disciplined assessments aligned with CREST professional practice. [View official CREST CRT information ](https://www.crest-approved.org/skills-certifications-careers/crest-registered-penetration-tester/) --- Hack The Box Academy ## HTB CWES HTB Certified Web Exploitation Specialist ### Issuer credibility Hack The Box operates HTB Academy, an interactive, hands-on cybersecurity training platform. ### Demonstrated capability Web-application and API penetration testing, bug-bounty methodology, risk evaluation, and actionable reporting. ### Customer value Supports practical assessment of modern web applications and APIs. [View official HTB Academy certification information ](https://academy.hackthebox.com/preview/certifications) --- GIAC ## GPEN GIAC Penetration Tester ### Issuer credibility GIAC develops and administers specialist information-security certifications. ### Demonstrated capability Penetration-test planning, reconnaissance, scanning, exploitation, post-exploitation, pivoting, and password attacks. ### Customer value Supports systematic infrastructure testing connected to realistic attack paths. [View official GPEN information ](https://www.giac.org/certifications/penetration-tester-gpen) --- GIAC ## GWAPT GIAC Web Application Penetration Tester ### Issuer credibility GIAC develops and administers specialist information-security certifications. ### Demonstrated capability Authentication, session, configuration, SQL injection, CSRF, XSS, and client-side injection testing. ### Customer value Adds depth to web assessments involving user accounts, sensitive data, and application attack paths. [View official GWAPT information ](https://www.giac.org/certifications/web-application-penetration-tester-gwapt) --- OffSec ## OSCE OffSec Certified Expert ### Issuer credibility OffSec provides hands-on cybersecurity training, labs, and professional certifications. ### Demonstrated capability Web attacks, userland exploit development, antivirus evasion, and network or edge-system attacks. ### Customer value Adds depth to assessments requiring exploitability analysis and low-level attack expertise. [View the official OSCE FAQ ](https://help.offsec.com/hc/en-us/articles/4403282452628-OSCE-FAQ) --- OffSec ## OSCP OffSec Certified Professional ### Issuer credibility OffSec provides hands-on cybersecurity training, labs, and professional certifications. ### Demonstrated capability Vulnerability identification, system exploitation, privilege escalation, Active Directory, and professional reporting. ### Customer value Supports practical testing backed by reproducible evidence and technically useful findings. [View official OSCP information ](https://help.offsec.com/hc/en-us/articles/360051719632-Certification-Badges-and-Pins-FAQ) --- OffSec ## OSEP OffSec Experienced Penetration Tester ### Issuer credibility OffSec provides hands-on cybersecurity training, labs, and professional certifications. ### Demonstrated capability Client-side attacks, antivirus and application allow-listing evasion, attack chaining, and advanced Active Directory. ### Customer value Helps assess how effectively layered defenses resist realistic attack paths. [View official OSEP information ](https://help.offsec.com/hc/en-us/articles/6333337739540-Advanced-Evasion-Techniques-and-Breaching-Defenses-FAQ) --- OffSec ## OSWE OffSec Web Expert ### Issuer credibility OffSec provides hands-on cybersecurity training, labs, and professional certifications. ### Demonstrated capability White-box testing, source-code analysis, vulnerability chaining, and custom exploit development. ### Customer value Supports deeper discovery of server-side and logic flaws beyond routine scanning. [View the official OSWE exam guide ](https://help.offsec.com/hc/en-us/articles/360046869951-WEB-300-Advanced-Web-Attacks-and-Exploitation-OSWE-Exam-Guide) --- CompTIA ## CompTIA PenTest+ CompTIA PenTest+ ### Issuer credibility CompTIA develops vendor-neutral IT training and certification products. ### Demonstrated capability Engagement management, reconnaissance, vulnerability analysis, exploitation, post-exploitation, lateral movement, and reporting. ### Customer value Supports a structured assessment from scope planning through actionable remediation. [View official PenTest+ information ](https://www.comptia.org/en-us/certifications/pentest/) --- COMPANY CERTIFICATE / PDF PREVIEW ## Company certificate Siam Thanat Hack company registration certificates in Thai and English ### Thai version [Download Thai version ](/assets/documents/sth-company-certificate-th.pdf) ### English version [Download English version ](/assets/documents/sth-company-certificate-en.pdf) --- CERTIFICATE / PDF PREVIEW ## Consultant registration Consultant registration certificate from the Ministry of Finance Consultant Database Center [Download ](/assets/documents/sth-certificate-of-consultant.pdf) --- OFFICIAL CREST REGISTRY ## Verify CREST Pathway Plus Learn who CREST is, what Pathway+ status means, and how it supports confidence when choosing STH as a penetration testing provider. ![CREST Pathway Plus](/assets/brand/crest-pathway-plus.png) Pathway+ registered organisation **Siam Thanat Hack** CREST is an international not-for-profit membership body that sets and raises standards for Cyber Security providers and professionals, giving buyers, governments, and regulators greater confidence in the industry. CREST Pathway+ recognises organisations that have progressed beyond the initial Pathway stage and completed an assessment against CREST company requirements in the Security Assessment discipline, which includes Penetration Testing and Vulnerability Assessment. The assessment helps measure readiness and identify opportunities to strengthen quality. STH's Pathway+ status and listing in the official CREST registry show a structured quality-improvement journey, alignment with CREST's Code of Conduct, and a commitment to strengthening governance, delivery methods, and information protection against internationally recognised standards. This gives clients a more transparent reference point when evaluating a penetration testing provider. [ Open the CREST registry at Siam Thanat Hack ](https://www.crest-approved.org/membership/pathway-plus-organisations/#:~:text=Siam%20Thanat%20Hack) --- DECISION GATE / ATTACK SURFACE ## Attack Surface We Carry Into Testing Turn the asset inventory into a map of entry points, trust boundaries, roles, and paths to sensitive data. ![Attack surface map for web, mobile, and network testing](/assets/process/decision-attack-surface-v1.webp) ### Web and API **Web attack surface and references** | Test area | Reference mapping | | --- | --- | | Entry points, routes, authentication, and sessions | OWASP WSTG v4.2; OWASP Top 10:2025 | | Object/function authorization, rate limits, and sensitive business flows | OWASP API Security Top 10:2023 | | Configuration, files, integrations, SSRF, and cloud storage | WSTG v4.2 and API Security | | Authorized adversary behaviors | MITRE Enterprise ATT&CK T1595 Active Scanning and T1190 Exploit Public-Facing Application | ### Mobile **Mobile attack surface and references** | Test area | Reference mapping | | --- | --- | | Package, code, update path, and tamper resistance | MASVS 2.1 CODE/RESILIENCE; MASTG 2.0 | | Local storage, cryptography, and privacy | MASVS-STORAGE, CRYPTO, and PRIVACY | | Authentication, platform, deep links, and network traffic | MASVS-AUTH, PLATFORM, and NETWORK | | Backend APIs and relevant behavior | API Top 10:2023; MITRE Mobile ATT&CK T1664, T1417, T1533 | ### Network **Network attack surface and references** | Test area | Reference mapping | | --- | --- | | Public services, VPN, gateways, and cloud edge | T1595, T1133, T1190 | | Internal hosts and service discovery | T1046 | | Identities and trust paths | T1078 | | Remote-service exploitation, segmentation, and lateral paths | MITRE Enterprise ATT&CK Discovery and Lateral Movement; T1210 | ### Outputs - Asset and endpoint inventory - Role and privilege matrix - Data-flow and trust-boundary map - Prioritized abuse cases and attack paths - Assumptions and exclusions ATT&CK is adversary-behavior knowledge used to map authorized, tested, and evidenced techniques. It is not a testing standard or coverage percentage. [Open OWASP WSTG v4.2 ↗](https://wstg.owasp.org/v4.2/)[Open OWASP MASVS ↗](https://mas.owasp.org/MASVS/)[Open MITRE ATT&CK ↗](https://attack.mitre.org/matrices/enterprise/) **Gate:** Confirm the high-value assets, trust boundaries, and justified attack paths selected for testing. --- DECISION GATE / COVERAGE ## Broader Coverage, Human-Owned Evidence AI performs reconnaissance and automated active testing within scope to increase speed and coverage; specialists control testing, validate impact, and approve every finding. ![Specialists and AI working together to expand assessment coverage](/assets/process/decision-human-ai-coverage-v1.webp) ### AI runs automated testing; humans remain accountable **AI and human roles across the assessment** | Phase | AI | Human | | --- | --- | --- | | Planning | Normalizes asset lists, suggests coverage gaps, and reference mappings | Approves scope, safety constraints, sequence, and test depth | | Testing | Performs reconnaissance, generates hypotheses, and runs automated active testing within scope | Controls testing, analyzes business logic, and validates exploitation | | Validation | Clusters artifacts and assists cross-reference checks | Reproduces findings, runs negative controls, and establishes scope and impact | | Reporting | Assists evidence indexing and draft trace links | Assigns rationale and approves wording, remediation, severity, and the final report | ### Evidence standard - Request/response or command/output - Timestamp and affected asset - Reproduction steps and preconditions - Positive proof plus a relevant negative control - Data, privilege, and business impact - Sanitized screenshot, recording, or PoC - Reviewer and status Gain faster, broader coverage without reducing accountability, reproducibility, or evidence quality. **Gate:** A finding enters the report only when it is reproducible, in scope, sufficiently evidenced, impact-backed, and human-reviewed. --- DECISION GATE / REPORT ## From Evidence to an Actionable Report One report set communicates clearly to executives, system owners, and remediation teams. ![Sample STH penetration testing report cover](/assets/process/sth-pentest-report-cover-sample.webp) ### Report anatomy 1. **Cover** Classification, customer, engagement, version, and date 2. **Executive Summary** Business impact at a glance 3. **Scope & ROE** Systems, exclusions, access model, and rules 4. **Methodology** Standards and coverage matrix 5. **Risk overview** Prioritized findings 6. **Finding Details** ID, assets, status, risk, CVSS score/vector, evidence, impact, and remediation 7. **Attack chain** Relationships between findings 8. **Recommended Solutions** Roadmap and remediation ownership 9. **Appendix** Evidence and framework traceability ### Initial Report and Revisit Report **Initial and post-remediation reporting** | Report | Core content | Evidence and outcome | | --- | --- | --- | | Initial Report | Original scope and dates, initial risk snapshot, findings, and recommendations | Complete evidence, remediation, and ownership | | Revisit Report | Retest scope/date/version with original finding ID and risk | Closed, Partially Remediated, Open, Unable to Verify, or Risk Accepted; before/after evidence, bypass results, and residual risk | **Gate:** Confirm facts, remediation owners, priorities, and items requiring revisit. --- DECISION GATE / RISK ## How We Build the Risk Rationale Separate technical severity from business risk and expose the assumptions, score, and vector for traceability. ![Conceptual risk rating from likelihood and impact](/assets/process/risk-likelihood-impact-matrix-v2.png) ### OWASP Risk Rating Risk = Likelihood × Impact **Factors and 0-9 thresholds** | Component | Factors | Thresholds | | --- | --- | --- | | Likelihood | Threat agent: skill, motive, opportunity, size; Vulnerability: discovery, exploit, awareness, detection | Low \<3, Medium 3-\<6, High 6-9 | | Impact | Technical: confidentiality, integrity, availability, accountability; Business: financial, reputation, compliance, privacy | Low \<3, Medium 3-\<6, High 6-9 | We score the relevant factors and place the result on the likelihood-impact matrix to make the risk level clear. We then review it against the customer’s business context and existing controls. If business data is unavailable, we use technical impact as the baseline and document the assumption. ### CVSS v4.0 ![Diagram of CVSS v4.0 metric groups: Base, Threat, Environmental, and Supplemental](/assets/process/cvss-v4-metric-groups-v2.png) **Metric groups used in calculation** | Group | Metrics | | --- | --- | | Base | AV, AC, AT, PR, UI and vulnerable/subsequent-system CIA impacts | | Threat | Exploit Maturity | | Environmental | Security requirements and Modified Base metrics for the customer environment | | Supplemental | Safety, automation, recovery, value density, response effort, and provider urgency are contextual only and do not change the score | CVSS gives every vulnerability a severity score on the same 0.0-10.0 scale. STH reports the score, severity rating, and CVSS vector so technical teams can validate or compare the result. We use FIRST’s CVSS v4.0 reference calculator to keep scoring consistent and transparent. ### Remediation priority We prioritize remediation by considering technical severity, verified exploitability, the importance of affected systems or data, customer business impact, and existing controls. The rationale for each priority is documented clearly. Executives see why remediation is prioritized; technical teams see the metrics and evidence behind the decision. [OWASP Risk Rating ↗](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology)[FIRST CVSS v4.0 Specification ↗](https://www.first.org/cvss/v4.0/specification-document)[FIRST CVSS v4.0 Calculator ↗](https://www.first.org/cvss/calculator/4.0) **Gate:** Confirm finding status, CVSS vector, OWASP risk rationale, business context, and remediation priority. --- DECISION GATE / SCOPE ## Scope & Rules of Engagement We agree targets, authority, test methods, and stop conditions before execution so the assessment can go deep while controlling business impact. ![Scope and Rules of Engagement planning before testing begins](/assets/process/decision-scope-roe-v1.webp) ### Systems and access to prepare **System scope and access required for testing** | System | Scope | Access | | --- | --- | --- | | Web and API | Domains, routes, APIs, admin portals, roles, and integrations | Test accounts, MFA path, API documentation, and test data | | Mobile | Android/iOS builds, package IDs, deep links, local storage, and backend APIs | Test builds, devices, accounts, source, or symbols when agreed | | External Network | Public IP ranges, DNS, VPN, gateways, cloud edge, and exposed services | Approved source IPs, maintenance window, and emergency contacts | | Internal Network | Subnets, hosts, Active Directory, identity, segmentation, and management services | VPN/jump host, test workstation, test identities, and routing prerequisites | ### Select the testing model that fits the objective **Black Box, Gray Box, and White Box comparison** | Model | Information and access | Best fit | Customer value | | --- | --- | --- | --- | | ![Black Box testing model illustration](/assets/generated/testing-models/black-box.webp) | Minimal public target information | An external attacker view | Realistic exposure validation | | ![Gray Box testing model illustration](/assets/generated/testing-models/gray-box.webp) | Test accounts and selected documentation | Roles, business logic, and authenticated paths | Balanced realism, depth, and delivery time | | ![White Box testing model illustration](/assets/generated/testing-models/white-box.webp) | Agreed architecture, source, configuration, and access | Deep coverage and root-cause analysis | Maximum technical visibility and remediation context | ### Rules of Engagement confirmed before testing - Written authorization and named approvers - In-scope and excluded assets - Allowed and prohibited techniques - Test window, source IPs, rate limits, and stop conditions - Production-data handling and evidence retention - Critical-event escalation - Cleanup, test-account removal, and revisit conditions **Gate:** Ready to begin when scope, access, the test window, ROE, and escalation paths are confirmed. --- [ ](/en/compliance/bank-of-thailand/#ai-risk) BANK OF THAILAND / AI RISK MANAGEMENT ## Bank of Thailand: Artificial Intelligence Risk Management - Wor 5994/2568 BOT policy guideline (document 25680178) offers principles and reference guidance for in-scope financial service providers to apply according to their AI use cases. ### Scope and Three Risk Dimensions (Clause 4.2) - Applies to financial institutions, specialized financial institutions (SFIs), and regulated payment systems and payment services providers. - Data risk: Data quality, recency, privacy, and security to prevent leakage or unauthorized disclosure of sensitive or personal data. - Model development risk: Explainability of model outputs and mitigation of unreliable, negative, biased, or fabricated results. - Cyber threat risk: Attacks targeting AI systems, including Prompt Injection, Model Inversion, Data Poisoning, and Adversarial Attacks. ### Technical Controls and Security Testing (Clause 4.4) - The guideline recommends protecting against disclosure of sensitive organizational information or undesirable output, for example through prompt and response content filtering. - It recommends continuous testing and monitoring of model performance and reliability before and after deployment, potentially using unseen data, noise, and edge cases; separately test relevant attack patterns continuously, such as data poisoning and adversarial attacks. - For strategic decisions or uses that directly affect customers, providers may consider human-in-the-loop or human-over-the-loop controls according to risk and impact. **Integration with Other BOT Rules** The guideline supplements relevant BOT requirements and guidance on IT risk, third-party risk, data governance, and market conduct. FEAT is cited as one example of generally accepted responsible-AI principles. [Open BOT AI Guideline Circular 5994/2568 ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2568/ThaiPDF/25680178.pdf) --- [ ](/en/compliance/bank-of-thailand/#compliance-matrix) BANK OF THAILAND / SECURITY ASSESSMENT ## Bank of Thailand Penetration Testing Guideline A prioritized summary of direct VA and Penetration Testing requirements, Mobile Banking security controls, and the supporting iPentest guideline. ### 1. SorNorChor. 1/2564 - direct VA and Penetration Testing requirements - Clause 5.1.6 requires vulnerability assessments for all systems according to risk at least annually and after significant changes. - Independent experts must conduct Penetration Testing of Internet-facing applications and networks at least annually and after every significant change. - Clause 5.1.6 forms part of the Cyber Hygiene requirements for designated significant payment-system providers and regulated payment-system or payment-service businesses that are not financial institutions or specialized financial institutions. ### 2. BOT Notification 4/2568 - Mobile Banking Security - It applies to all financial institutions under the Financial Institution Business Act that provide Mobile Banking as defined by the notification. - It establishes minimum Mobile Banking controls including secure protocols and certificate pinning, anti-tampering, session security, source code obfuscation, and rooted or jailbroken device detection. - Use these controls as a baseline when defining Mobile Application Penetration Testing scope and test cases, while confirming the current notification and checklist used by your organization. ### 3. BOT Notification SKCH 5/2566 - IT risk supervision for financial institutions - Clause 6.6 requires risk-based vulnerability assessment across all systems. Critical systems must be assessed at least annually and after significant changes. - Clause 6.7 requires independent internal or external experts to conduct penetration testing covering at least Internet-facing applications and networks, at least annually and after significant changes. - Clause 8 applies to financial institutions and specialized financial institutions providing financial services through a Mobile Banking Application. Aggregate downtime must not exceed eight hours per calendar year, and service must be restored promptly. ### 4. iPentest - supporting guidance for intelligence-led testing - Use threat intelligence to create scenarios and scope critical functions, including protection, detection, and response processes. - Use it for deeper readiness assessment beyond routine VA and Penetration Testing, with rigorous control of risk, scope, timing, and communications. **Applicability** The four documents have different regulated audiences and purposes. Before defining scope for a BOT submission, confirm the latest notification, circular, checklist, and reporting format with your organization's Compliance team. [ Open SorNorChor. 1/2564 ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2564/ThaiPDF/25640024.pdf) [ Open BOT Notification 4/2568 ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2568/ThaiPDF/25680027.pdf) [ Open BOT Notification SKCH 5/2566 ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2566/ThaiPDF/25660202.pdf) [ Open the iPentest guideline ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2562/ThaiPDF/25620192.pdf) --- [ ](/en/compliance/bank-of-thailand/#bot-va-pentest) BANK OF THAILAND / CYBER HYGIENE ## Bank of Thailand: VA and Penetration Testing - SorNorChor. 1/2564 Direct Cyber Hygiene requirements for Vulnerability Assessment and Penetration Testing by payment-system providers and operators within the notification's scope. ### Vulnerability Assessment - Clause 5.1.6 requires vulnerability assessments for all systems according to risk at least annually and after significant changes. ### Penetration Testing - Independent experts must conduct Penetration Testing of Internet-facing applications and networks at least annually and after every significant change. **Applicability** The notification applies to designated payment-system providers and regulated payment-system or payment-service businesses that are not financial institutions or specialized financial institutions. Confirm the entity's licence and the latest applicable notifications with Compliance. [Open SorNorChor. 1/2564 ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2564/ThaiPDF/25640024.pdf) --- [ ](/en/compliance/cybersecurity-act/) NATIONAL CYBERSECURITY / RISK & AUDIT ## Cybersecurity Act B.E. 2562 (2019) and Penetration Testing The Act establishes cybersecurity risk-assessment and audit duties. Penetration Testing is a technical method and source of evidence that may support those duties; it is not the entire audit. ### Statutory duties - Section 44 requires government agencies, regulators or supervisors, and critical information infrastructure (CII) organizations to create a code of practice and standards framework whose minimum content includes an annual cybersecurity inspection and risk-assessment plan. - Section 54 specifically requires CII organizations to arrange a cybersecurity risk assessment and cybersecurity audit at least annually, then send a summary to NCSA within thirty days after completion. ### Role of Penetration Testing - Penetration Testing is technical evidence supporting risk assessment and audit, not the whole audit. - Clauses 21.3.4 and 21.3.6 of the B.E. 2564 (2021) Code of Practice use recommendatory risk-and-need wording for Penetration Testing, focusing on critical and Internet-facing services. - When performed, scope should cover the relevant host, network, and application layers, and testers should be independent of the systems and processes under assessment. **Requirement boundary** The Act does not require every organization to conduct annual Penetration Testing. Keep the statutory risk-assessment and audit duties distinct from the technical testing method selected to support them. [Open the Cybersecurity Act B.E. 2562 (2019) ](https://ratchakitcha.soc.go.th/documents/17082306.pdf) [Open the B.E. 2564 (2021) Code of Practice ](https://ratchakitcha.soc.go.th/documents/17176753.pdf) --- [ ](/en/compliance/sec/#digital-asset) SEC / DIGITAL ASSET BUSINESS ## Penetration Testing Requirements for Digital Asset Businesses Thai SEC requirements for licensed digital-asset businesses, not requirements issued by the Stock Exchange of Thailand. ### Direct requirements for critical systems - It covers relevant licensed digital-asset business types, including exchanges, brokers, dealers, advisory services, and fund managers. - Clause 18 requires Penetration Testing of critical systems before service commencement and at least annually after commencement, performed by a person independent of the IT unit responsible for the systems. - Results must be reported to the SEC within 30 days of receiving the official result and no later than 90 days after the testing process ends. - Scope should reflect the license's actual critical systems, such as trading, wallet or custody, customer portals, APIs, infrastructure, and supporting systems affecting the service. **The regulator is the SEC** Digital-asset businesses are regulated by the Thai SEC, not the Stock Exchange of Thailand. Applicable details depend on license type and the latest consolidated rules. [Open the SEC digital-asset business rules ](https://publish.sec.or.th/nrs/8138p_r.pdf) --- [ ](/en/compliance/bank-of-thailand/#bot-emoney-security) BANK OF THAILAND / ELECTRONIC MONEY ## Bank of Thailand: e-Money and Security Testing SorNorChor. 7/2561 establishes rules for electronic-money service operators under the Payment Systems Act. ### How it relates to Penetration Testing - It applies to authorized or registered e-Money operators under the Payment Systems Act. - Clauses 4.2.6-4.2.10 address limits, registration and loss reporting, refunds, balance and expiry checks, and control of transfers through the provider's system. - SorNorChor. 7/2561 does not directly prescribe a Penetration Testing schedule. These flows should instead inform e-Money business-logic and abuse-case testing. - Direct VA/Penetration Testing obligations for in-scope operators arise from applicable IT Risk and Cyber Hygiene rules, such as SorNorChor. 1/2564. **Map the correct rules to scope** Holding an e-Money license does not make every provision of SorNorChor. 1/2564 apply identically. Confirm license type, significance, and the current notifications with Compliance before testing. [Open BOT e-Money regulations ](https://www.bot.or.th/th/our-roles/payment-systems/payment-act-oversight/Notification-and-Circulars-under-Payment-Systems-Act-BE-2560.html) --- STRICT DISCLOSURE & ETHICS ## Confidential & Authorized Every assessment must be authorized, clearly scoped, confidential, and conducted without damaging or disrupting business operations. ### Confidentiality and ethics principles - Begin testing only with written authorization and mutually agreed scope and Rules of Engagement. Never access systems, people, or data outside scope. - Restrict access to client information, findings, and evidence on a need-to-know basis. Use encrypted transfer and storage with defined retention and deletion periods. - Define testing windows, request rates, stop conditions, and emergency contacts. Avoid destructive tests, data modification, and persistence unless explicitly approved. - Collect only necessary evidence, redact personal and commercially sensitive information, and report only results reproduced and confirmed by an expert. - Never disclose, exploit, or share client information or vulnerabilities without authorization. Keep AI use under human control and never send client data to public AI services. **Safety First** Penetration Testing should prove risk safely and provide actionable remediation information, never cause damage, disrupt services, or increase business risk. [ Report a vulnerability responsibly to pentest@sth.sh ](mailto:pentest@sth.sh?subject=Responsible%20Disclosure) --- [ ](/en/compliance/bank-of-thailand/#bot-ipentest) BANK OF THAILAND / INTELLIGENCE-LED TESTING ## Bank of Thailand: iPentest - Circular 1252/2562 The 2019 Intelligence-led Penetration Testing (iPentest) circular addressed commercial banks and assesses readiness to protect against, detect, and respond to cyber threats. ### 1. Governance and testers - Establish oversight involving relevant functions, including IT Risk Management and Compliance, with clear owners and tester-selection criteria. ### 2. Threat-informed scope - Use threat intelligence to build realistic scenarios and scope critical functions, people, and the processes used to protect, detect, and respond. ### 3. Risk controls - Prefer production testing for realism, while high-risk steps may move to UAT or pre-production and must be identified in the report. - Keep scope and timing confidential, define test-risk controls and communications, and use results for remediation planning. **Applicability** The 2019 circular was addressed to commercial banks. It directed D-SIBs and commercial banks with high Cyber Inherent Risk to implement the guideline by 2020, while other commercial banks considered their risk and readiness. It is not a universal annual requirement for every financial institution. [Open the Bank of Thailand iPentest guideline ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2562/ThaiPDF/25620192.pdf) --- [ ](/en/compliance/iso-27001/) INFORMATION SECURITY MANAGEMENT ## ISO/IEC 27001:2022 and Penetration Testing An information security management system (ISMS) standard for systematically managing risks to information, people, processes, and technology. ### Requirements related to Penetration Testing - ISO/IEC 27001:2022 does not require every organization to conduct Penetration Testing on a fixed schedule. It requires organizations to identify, assess, and treat information security risks systematically. - Penetration Testing can provide a control activity and supporting evidence for Annex A 8.8 technical vulnerability management, A.8.29 security testing in development and acceptance, and A.5.35 independent review of information security. - Scope and frequency should be based on risk assessment results, legal, regulatory, and contractual obligations, and system criticality. - Test results should feed risk treatment, remediation, risk acceptance, and evidence of continual ISMS improvement. **Key point** ISO/IEC 27001 is a risk-based standard, not a test-case list. Penetration Testing should therefore be tied to each organization's risks and Statement of Applicability. [ Open ISO/IEC 27001:2022 information from ISO ](https://www.iso.org/standard/27001) --- [ ](/en/compliance/mitre-attack/) THREAT-INFORMED SECURITY ## MITRE ATT&CK® and Penetration Testing A knowledge base of adversary behaviors structured into tactics and techniques to align security assessments with real-world threats. ### Role in testing - ATT&CK helps testing teams select observed adversary behaviors relevant to the threat model, attack surface, and criticality of the system. - It can inform adversary-emulation plans, map evidence to attacker behavior, and communicate gaps across protection, detection, and response. ### Derive coverage from actual risk - Mapping test results to ATT&CK improves traceability; it does not prove that every technique was tested or that risk coverage is 100%. - Scope must reflect business context, architecture, and relevant threat intelligence rather than selecting test cases from the matrix alone. **Knowledge-base boundary** ATT&CK is a knowledge base and model of observed adversary behavior. It is not a regulator, standard, certification, or a 100%-coverage checklist. [Open MITRE ATT&CK Resources ](https://attack.mitre.org/resources/) --- [ ](/en/compliance/bank-of-thailand/#bot-mobile-banking-security) BANK OF THAILAND / MOBILE BANKING ## Bank of Thailand: Mobile Banking Security - Notification 4/2568 Minimum Mobile Banking measures used as a testing control baseline, with the Biometric Technology guideline as supplemental guidance where biometrics are used. ### 1. Notification scope - BOT Notification 4/2568 applies to all financial institutions providing Mobile Banking as defined by the notification. ### 2. Mobile Penetration Testing baseline - Testing should assess secure protocols and certificate pinning, anti-tampering, session security, source-code obfuscation, rooted or jailbroken device handling, and risks from remote-control software or malware. - Assess the connected mobile application, API/backend, authentication, transaction flows, and fraud or business-logic controls together. ### 3. Biometric Technology as supplemental guidance - Where biometrics are used, assess trusted sources, presentation-attack detection or liveness, biometric-data protection, and lifecycle risk management. **Testing cadence** The Mobile Banking notification and Biometric guideline provide a control baseline; they do not independently prescribe a Penetration Testing cadence. Apply the IT Risk requirements governing the organization. [Open BOT Notification 4/2568 ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2568/ThaiPDF/25680027.pdf)[Open the Biometric Technology guideline ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FPG/2566/ThaiPDF/25660181.pdf) --- [ ](/en/compliance/ncsa-website-standard/) NCSA / WEBSITE SECURITY STANDARD ## NCSA Website Security Standard B.E. 2568 The Website Security Standard covers governance and security operations across website architectures. ### Who is in scope and how Penetration Testing supports it - It applies to government agencies, regulatory or supervisory bodies, and Critical Information Infrastructure organizations. General private-sector adoption is encouraged. - The notification was issued on 16 September 2025 and takes effect after one year, on 16 September 2026. - In-scope organizations perform the ค1 self-assessment at least annually, determine impact level, report accordingly, and create a ค2 remediation plan for gaps. - The standard does not automatically turn the annual self-assessment into a blanket annual Penetration Testing requirement. Penetration Testing provides technical evidence for Website Security Operation and exploitable-vulnerability validation. **Derive scope from impact** Scope should cover the web application, web server, database, and relevant cloud or web-hosting components according to the architecture and website impact level, rather than testing only the public pages. [Open the Website Security Standard in the Royal Gazette ](https://ratchakitcha.soc.go.th/documents/86192.pdf) --- [ ](/en/compliance/ndid/) NATIONAL DIGITAL ID ## Penetration Testing Requirements for NDID Members NDID is infrastructure for digital identity proofing and authentication that connects participating service providers in different roles. ### What members prepare for a security assessment - Test the member applications, web systems, network layer, and operating systems involved in the NDID Platform connection. The NDID Node is excluded unless the issued criteria state otherwise. - The onboarding criteria supplied by the user call for an external juristic-person testing provider and evidence of tester qualifications such as GPEN, eCPPT, OSCP, or another certification accepted by NDID for the member role. - Testing follows OSSTMM or NIST SP 800-115 with the OWASP Web/Mobile Testing Guide, or PTES/ISSAF, according to the criteria issued to the member. - Critical, High, and Medium findings must be corrected. Low findings are corrected or supported by a recorded rationale, and corrected vulnerabilities are retested. - The member submits the final Penetration Test Report and tester certificate to NDID. The supplied criteria state at least annually and after significant changes. **Confirm the current criteria** Details may differ by member role and onboarding package. This summary reflects the criteria supplied by the user, not a publicly controlled document. Members should follow the latest criteria received from NDID. [Open the NDID website ](https://ndid.co.th/en/home-en/) [Read an NDID service overview ](https://www.scb.co.th/th/personal-banking/other-services/ndid.html) --- [ ](/en/compliance/oic/) OFFICE OF INSURANCE COMMISSION / IT RISK ## Office of Insurance Commission (OIC) IT Risk B.E. 2563 (2020) establishes information technology risk governance and management criteria for life and non-life insurance companies. ### OIC Penetration Testing Requirements and IT Risk Management - Applies to life and non-life insurance companies supervised by the Office of Insurance Commission, establishing expectations for IT Governance, Information Asset Management, IT Risk Management, and Cybersecurity Controls. - Clause 21(6) explicitly mandates that insurers engage external specialists to perform penetration testing on internet-facing applications and networks regularly, or whenever significant system changes occur. - Testing must be executed alongside vulnerability management and security monitoring aligned with evaluated risk levels, scoped from the information asset inventory and formal risk assessments. - Critical systems within scope include online policy issuance systems, claims processing applications, customer and agent portals, mobile applications, insurance APIs, internet-facing systems, core insurance platforms, and policyholder databases. - Findings must feed into a formal Risk Treatment Plan with assigned control owners and documented retest evidence, supporting executive reporting and mandatory annual IT audits. **Key Regulatory Alignment** OIC regulations require regular external penetration testing for internet-facing systems. Technical test results provide auditable evidence of control effectiveness, supporting ongoing IT risk management and mandatory annual IT audits. [Open the IT Risk notification for life insurers ](https://oiceservice.oic.or.th/document/Law/file/11389/11389_3956dee0c06add1ae53b1e3ce8a3e3c4.pdf) [Open the IT Risk notification for non-life insurers ](https://oiceservice.oic.or.th/document/Law/file/11390/11390_1ac51c44586c17267e2c56dde4914c39.pdf) --- [ ](/en/compliance/owasp-top-10/) WEB APPLICATION RISK AWARENESS ## OWASP Top 10 and Penetration Testing An awareness document representing broad consensus on critical web application risks, helping organizations prioritize what to prevent and assess. ### Reference versions by system type **Web Application** - OWASP Top 10:2025 **Mobile** - OWASP Mobile Top 10 2024 **API** - OWASP API Security Top 10 2023 **LLM** - OWASP Top 10 for LLM Applications 2026 ### How it relates to Penetration Testing - Testers use these categories to plan coverage and map findings to risk language shared by developers, executives, and auditors. - The OWASP Top 10 is not a testing standard or a checklist covering every test case, and it should not replace a Penetration Testing methodology. - A sound assessment should use OWASP WSTG and ASVS alongside tests for business logic, APIs, authentication, authorization, and system-specific context. **Key point** Finding no OWASP Top 10 issues does not mean a system is risk-free. Scope and test cases must always reflect the real attack surface. [ Open OWASP Top 10:2025 ](https://owasp.org/Top10/2025/) --- [ ](/en/compliance/pci-dss/) PAYMENT CARD INDUSTRY DATA SECURITY STANDARD ## PCI DSS v4.0.1: Vulnerability Assessment, ASV Scanning, Pentest and Segmentation Testing The security standard for entities that store, process, transmit, or can affect the security of payment card data. ### Security Testing and Vulnerability Management Requirements - PCI DSS is published by the PCI Security Standards Council and applies to merchants, acquirers, issuers, processors, and service providers within or impacting the Cardholder Data Environment (CDE). - Requirement 11.3.1 (Internal VA): Mandatory quarterly internal scans using authenticated credentials, remediating High/Critical flaws with rescans, and re-evaluating after significant changes. - Requirement 11.3.2 (External ASV Scans): Mandatory quarterly external scans performed by a certified Approved Scanning Vendor (ASV), achieving passing scan status (zero CVSS ≥ 4.0 or auto-fail items). - Requirement 11.4 (Penetration Testing): Internal and external penetration testing conducted at least once every 12 months and after significant changes, covering network and application layers with mandatory retests. - Requirements 11.4.5 & 11.4.6 (Segmentation Testing): Validating CDE scope-reduction isolation at least annually for merchants (Req 11.4.5) and every 6 months for service providers (Req 11.4.6). **Before a compliance submission** Scope, frequency, tester qualification, and evidence depend on the entity and assessment method, such as SAQ or ROC. Confirm the current PCI DSS v4.0.1 text with your QSA or Compliance team. [Open the PCI SSC Document Library ](https://www.pcisecuritystandards.org/document_library/) --- [ ](/en/compliance/pdpa/) PERSONAL DATA PROTECTION ## Personal Data Protection Act B.E. 2562 (2019) and Penetration Testing Section 37 requires data controllers to provide appropriate security measures. Penetration Testing is one way to validate the effectiveness of technical controls. ### Section 37 duty - A data controller must provide appropriate security measures to prevent unauthorized or unlawful loss, access, use, alteration, correction, or disclosure of personal data. - Minimum safeguards must include organizational and technical measures and may include physical measures where necessary according to risk. They must be reviewed when necessary or when technology changes. ### Sub-regulations and Enforcement Criteria - **Data Breach Notification (B.E. 2565)**: Controllers must notify the PDPC without undue delay and, where feasible, within 72 hours of awareness unless the breach poses no risk to rights and freedoms. High-risk breaches also require notification to affected data subjects without undue delay. - **Cross-Border Data Transfers (Sections 28 & 29 B.E. 2566)**: Assess destination protection and section 28(1)-(6) exceptions, or section 29 mechanisms such as BCRs reviewed and certified by the Office or enforceable contractual safeguards meeting the notification criteria. - **DPO Designation (Section 41(2) B.E. 2566)**: Section 41(2) combines core activities requiring regular monitoring with large-scale data; 100,000 data subjects is one deemed large-scale case. Section 41(3) separately covers core processing of section 26 data. ### Role of Penetration Testing - Testing can validate whether technical controls across web, mobile, API, network, and cloud environments resist unauthorized access or disclosure in practice. - Assessments must be authorized and risk-based, minimize unnecessary personal-data collection, redact evidence, and define secure retention and deletion. **Not complete compliance evidence** The PDPA does not mandate annual Penetration Testing. Section 37 and the security-measures notification require appropriate measures, while testing is one way to validate technical controls; a test report alone is not evidence of complete PDPA compliance. [Open the Personal Data Protection Act ](https://ratchakitcha.soc.go.th/documents/17082307.pdf) [Open the B.E. 2565 security-measures notification ](https://ratchakitcha.soc.go.th/documents/17211326.pdf) --- [ ](/en/compliance/sec/#requirements) SECURITIES AND EXCHANGE COMMISSION ## SEC Penetration Testing Requirements Information technology requirements for regulated businesses, designed to ensure important systems are appropriately tested, reported, and remediated. ### Core Penetration Testing requirements - Internet-facing application systems and networks must be tested at least annually and whenever they undergo a significant change. - Other systems require an assessment of intrusion risk through internal networks to determine an appropriate testing scope. - Testing must be performed by an internal or external specialist independent of the system owner and development. Scanner-only testing is a vulnerability assessment and cannot replace Penetration Testing. - Identified vulnerabilities must be remediated and mitigated promptly. Reports must be retained for at least two years and provided to the SEC on request. - Reports should identify the tester, date, scope, vulnerabilities, detection methods, risk ratings, and recommended remediation. **Applicability** Applicable requirements depend on the business's licence and governing notices. Confirm them with Compliance or legal counsel before defining scope. [ Open the SEC Penetration Testing requirements ](https://publish.sec.or.th/nrs/10474s.pdf) [ Open the SEC information technology Q&A ](https://publish.sec.or.th/nrs/9625p_r.pdf) --- AWARD / PDF PREVIEW ## Prime Minister Awards 2024 Thailand Cybersecurity Excellence Award 2024 - Contribution Award [Download ](/assets/documents/sth-prime-minister-awards-2024.pdf) --- AWARD / PDF PREVIEW ## Prime Minister Awards 2025 Thailand Cybersecurity Excellence Awards 2025 - Best Performance Awards [Download ](/assets/documents/sth-prime-minister-awards-2025.pdf) --- SME-GP / PDF PREVIEW ## SME-GP registration SME registration certificate for government procurement [Download ](/assets/documents/sth-sme-gp-registration.pdf) --- VAT REGISTRATION / PDF PREVIEW ## VAT registration (PP.20) VAT registration copies for the head office and Branch 1 ### Head office [Download head office copy ](/assets/documents/sth-vat-registration-head-office.pdf) ### Branch 1 [Download Branch 1 copy ](/assets/documents/sth-vat-registration-branch-1.pdf) Last updated 16 October 2026