Cybersecurity in Malaysia

Start with who will do the testing. A subcontractor testing on behalf of your main contractor needs its own NACSA licence. Then ask whether a person tests by hand or a scanner does all the work, and whether the retest is in the price, because many quotes leave it out. Ask to see a sample finding too: severity, evidence and a fix your developers can follow. We use automated and AI tools to cover ground quickly, but a person on our team checks every finding, and the access-control bugs that matter most are found by hand.

Yes. Under the Cyber Security Act 2024 (Act 854) and its licensing regulations, P.U. (A) 221/2024, penetration testing is one of two cyber security services that need a licence from NACSA. The other is managed security operations centre monitoring. The rule covers anyone who provides or advertises the service, including foreign companies serving clients in Malaysia. It does not apply when a company serves only its related companies, or when the system being tested sits outside Malaysia. NACSA publishes licensed providers on its licensing portal, licence.nacsa.gov.my.

Testing one web application usually costs RM 5,000 to RM 20,000, depending on how many user roles, integrations and payment flows it has. A larger app or API suite runs RM 15,000 to RM 45,000. A full infrastructure assessment covering servers, network, cloud and compliance documents runs RM 20,000 to RM 80,000. Our quotes include one retest after your fixes. A quote under about RM 3,000 is almost always an automated scan, not a penetration test. Our penetration testing cost guide on the blog explains what moves the price.

Yes. Our Government VAPT case study covers a platform that manages entrepreneur programme participants across multiple districts and user roles, so it holds a lot of personal data. We ran grey-box testing across the web app, APIs, database and infrastructure, against OWASP, the OWASP API Top 10 and PTES. We found 11 issues, including a SQL injection risk, broken access control that exposed participant records, and a database open to the public internet. After the client's team fixed them, we retested and issued a clean closure report mapped to the PDPA and the Dasar Keselamatan ICT Kerajaan.

It depends on what sits behind the login. A company website with a contact form and no customer accounts may only need a scan, plus fixing what it finds. A full test earns its price when the system holds customer data or payments, or when a client, an auditor or the PDPA means you need proof that someone competent looked. What you should not do is buy a scan and file it as a penetration test.

VAPT stands for vulnerability assessment and penetration testing. The vulnerability assessment scans broadly to list weaknesses, then the penetration test exploits them to prove what an attacker could actually reach. Run together, they give you both coverage and proof of real-world impact. At Gotchaa Lab, VAPT covers web applications, APIs, databases and infrastructure, tested against OWASP, the OWASP API Top 10 and PTES, with every finding ranked by CVSS v3.1 and backed by proof-of-concept evidence and step-by-step fixes.

Yes, if it processes personal data in commercial transactions. The Personal Data Protection Act 2010 covers customer names, emails, phone numbers, payment details, health records and anything else that identifies a person. The 2024 amendments raised the penalty for breaching the data protection principles to RM 1 million and up to three years in prison, and added a duty to notify data breaches. In practice you need consent before collecting data, you use it only for the stated purpose, you store it securely, and you let people see or correct their data. We run PDPA gap checks against the Act's seven principles, covering your forms, storage, access controls and privacy policy.

Yes. We map each VAPT finding to the relevant compliance requirement, including the seven principles of Malaysia's Personal Data Protection Act (PDPA) and, for government and GLC systems, the Dasar Keselamatan ICT Kerajaan. After your team remediates the issues, we retest and issue a clean closure report. That report gives auditors written proof the risks were resolved, so the assessment slots straight into your compliance sign-off rather than sitting as a separate exercise.