Veraksa
Consult

IT & cybersecurity consulting
for startups, fintech, and enterprise.

PENTEST · AUDIT
SOC · CLOUD

Done by practitioners.
Through to retest.
Fluent in local regulation.

Veraksa Cybersecurity Solution.

Veraksa helps you prove your systems are secure: penetration testing, compliance audits, SOC, and cloud security, until findings are fixed and retested.

Free consultation See services

Talk directly to a practitioner.

Your first scoping session is free, with no sales middleman.

Chat on WhatsApp

Trusted by engineering and compliance teams at

SAMPLE
  • Bank Nusantara
  • PayKita
  • Arunika Health
  • Persero Energi
  • Lumbung.id
  • Asuransi Sentosa
  • Kirana Logistik
  • Dana Rakyat
  • Sinar Telekom
  • Medika Prima
  • Tokoloka
  • Garuda Sekuritas
  • Nusa Cloud
  • BPR Mandala
  • Rumah Sehat
  • Jalur Bayar
Engagements completed
120+
Findings reported
1,500+
Critical findings closed
98%
Team experience
8+ yrs

These figures are samples and will be replaced with real data. SAMPLE

We find the gaps, help your team close them, then retest until they are proven closed.

Four services.
One standard: proven.

VAPT & Penetration Testing

Web, mobile, API, and infrastructure tested the way a real attacker would, within a scope agreed up front.

  • Web application
  • Mobile Android & iOS
  • REST & GraphQL API
  • Network & infrastructure
  • Cloud (AWS, GCP, Azure)
  • Internal & Active Directory

Methodology

OWASP WSTG, OWASP MASVS, PTES, NIST SP 800-115

What you get

Technical report, executive summary, exploitation evidence, retest

VRK-014 · HighSAMPLE

IDOR on the invoice endpoint exposes other customers’ data

  1. Open
  2. Fixed
  3. Retested

Audit & Compliance

Gap assessments against ISO 27001, PCI DSS, or UU PDP, mapped to the technical controls you already have.

ISO/IEC 27001:2022

SOC & Managed Detection

Monitoring and incident response with clear escalation and reports management can actually read.

24/7 monitoring

Cloud & DevSecOps

Cloud posture reviews and security gates in your pipeline, before gaps reach production.

AWS · GCP · Azure

Built for audited and regulated sectors:

  • Banking
  • Fintech & payments
  • Insurance
  • State-owned (BUMN)
  • E-commerce
  • SaaS & startups
  • Healthcare

One engagement,
many obligations answered.

Every service is mapped to the regulations and standards that bind your business, so the results are ready for your audit.

ServiceUU PDPPOJK 11/2022ISO 27001:2022PCI DSS v4.0
VAPT & PentestSupports Article 35Supports Security testingSupports A.8.8Supports Req. 11
Audit & ComplianceSupports Gap analysisSupports Gap analysisSupports Clauses 4–10Supports SAQ / ROC prep
SOC & DetectionSupports Incident notificationSupports MonitoringSupports A.8.16Supports Req. 10
Cloud & DevSecOpsSupports Article 35Supports Cloud & ITSupports A.5.23 · A.8.25Supports Req. 6

Article and control references will be verified against the official texts before launch.

We stay until the gap is closed.

An engagement only ends after every finding is fixed and retested.

  1. Scope

    A free session to understand your systems, regulations, and goals.

  2. Test

    Testing by the same practitioner who scoped the work.

  3. Fix

    We support your team as they close every finding.

  4. Retest

    Every fix is retested until it is verified.

See what our reports look like.

An executive summary for the board, technical detail for engineers, and regulatory mapping for auditors, in one document.

  • Severity based on CVSS v4.0 and business impact
  • Reproduction steps and evidence for every finding
  • Fix recommendations specific to your stack
  • Retest status per finding
Request a sample report

Results you can measure.

Engagement summaries backed by traceable data, not claims.

Mobile and API pentest before a payments feature launch.

Payments fintech

SAMPLE
Findings
14
Critical
3
Retested
100%

ISO 27001 gap assessment and certification audit readiness.

State-owned enterprise

SAMPLE
Controls
93
Priority gaps
21
Duration
4mo

Why Veraksa.

Done by practitioners.

The person who scopes your engagement is the person who tests your systems. No sales layer in front of junior testers.

Through to resolution.

We support remediation and retest every fix. A report without a retest is just a list of worries.

Fluent in local regulation.

Findings are mapped to UU PDP, POJK, and the standards you pursue, in language auditors and boards understand.

The practitioners you will talk to.

SAMPLE
  • Practitioner NameLead Penetration TesterOSCP · OSWE
  • Practitioner NameGRC & Compliance LeadISO 27001 LA · CISA
  • Practitioner NameSOC LeadGCIH · BTL1
  • Practitioner NameCloud Security EngineerAWS Security · CCSP
  • OSCP
  • OSWE
  • CISSP
  • CISA
  • ISO 27001 Lead Auditor
  • GCIH
  • CCSP
  • CEH
SAMPLE

From teams we have tested.

“We took the report straight into our board meeting and handed it to the auditor without rewriting it.”
Client Name · CTO, fintech company SAMPLE
“The person testing was the same person we talked to at the start. Communication was much faster.”
Client Name · Head of Engineering, SaaS SAMPLE
“Our ISO 27001 gaps were mapped per control, so the team knew exactly what to do first.”
Client Name · IT Risk Manager, state-owned enterprise SAMPLE

Notes from the field.

SAMPLE

A UU PDP checklist for engineering teams: from Article 35 to the sprint backlog.

UU PDP · 6 min read · coming soon

Vulnerability scan or pentest? How to choose by risk and budget.

Pentest · 5 min read · coming soon

Preparing for an ISO 27001:2022 audit without piles of unused documents.

ISO 27001 · 8 min read · coming soon

Common questions.

How is VAPT different from a vulnerability scan?

A scanner finds candidate weaknesses. A pentest verifies which ones are actually exploitable, chains small issues into real attacks, and removes false positives.

Can the report be used for an ISO 27001 or OJK audit?

Every finding is mapped to the relevant controls, so the report can serve as supporting evidence in your audit.

Does a retest cost extra?

Retesting in-scope findings is included in the engagement.

How long does an engagement take?

It depends on scope. We give a time and cost estimate after the free scoping session.

Start with one conversation.

Tell us about your systems. We will tell you honestly what needs testing.

Chat on WhatsAppSend an email

halo@veraksa.id · Reply within 1 business day SAMPLE