Short answers to the things we are asked most often before an engagement begins.
Two service lines: security assessment (web, API, source code, external infrastructure, cloud configuration, and AI systems) and custom AI engineering for day-to-day operations. Details are on the Security Assessment and Custom AI Engineering pages.
Send a short brief to founder@cyberagent.id. We reply within 45 minutes during WIB business hours and arrange a 30-minute scoping call at no cost.
A focused assessment generally takes 2–4 business days, a standard assessment 5–10 business days, and an in-depth assessment 2–4 weeks. The final duration is set during scoping, based on the number of assets and the depth of the review. For AI projects, the phases follow the agreed discovery and prototype.
OWASP Top 10, OWASP API Security Top 10, OWASP LLM Top 10, OWASP ASVS/WSTG, MITRE ATT&CK, NIST CSF 2.0, ISO/IEC 27001, PTES, and CVSS for severity scoring. Details are on the Methodology & Standards page.
Yes. A mutual NDA and a testing authorization letter are signed before any work begins. Client names and engagement details are not published without written consent.
Data accessed during an engagement is used only for that engagement, is not copied outside the agreed environment, and is deleted after the report has been accepted. For AI projects, customer data is never used to train third-party models.
No. Our disclosure program is recognition-only — no payment or bounty. What we offer is fast confirmation, fixes that are actually shipped, and public acknowledgement if you want it. Details are on the Vulnerability Disclosure page.
Not yet. The public dashboard and API are marked coming soon and will be opened once testing is complete. During this period, every service is handled directly by email.
We report it early through the agreed communication channel — we do not wait for the final report. For findings that require a fast decision, we include the impact and interim mitigation options.
Billing is handled through a B2B invoice with the payment terms agreed in the proposal. For development work, the code and configuration we build belong to you.
Email founder@cyberagent.id for service questions, or founder@cyberagent.id (subject: Vulnerability report) specifically for vulnerability reports.