PENETRATION TESTING · VAPT · A TECTONY SERVICE
Penetration Testing (Pentest) & VAPT in Thailand
Find the weak points before a real attacker does, only on systems you authorize in writing
TecTony's penetration testing (pentest) service is a scoped, simulated attack on your website, web application, mobile app, API and network, to prove which weaknesses can really be exploited and what that would mean for the business. Every engagement starts with a signed authorization and scope agreement. Testing is manual, supported by tools, not an automated scan alone, and ends with a Thai and English report, remediation guidance and a retest.
Only systems authorized in writing are tested · Results are a point-in-time assessment · No system can be guaranteed 100% secure
VA, PT and VAPT: what is the difference?
VA · Vulnerability Assessment
Automated scanning across your systems that lists possible weaknesses. Useful as a regular health check, but it does not prove anything can be exploited, and it often includes false alarms.
PT · Penetration Testing
A tester works by hand to confirm which weaknesses can really be exploited, how far an attacker could get, and what data or operations would be affected, with evidence for every finding.
VAPT
Both together: VA for breadth, PT to confirm the issues that matter most. Enterprises and compliance teams often ask for this format.
What the pentest and VAPT service covers
01 · Authorization and scope
Before any system is touched, we prepare a written authorization and Rules of Engagement: in-scope systems, test windows, systems that are off-limits, permitted methods, emergency contacts, and a PDPA data-processing agreement, signed by someone with authority over those systems.
02 · Vulnerability assessment (VA)
An authorized security health check: scanning, configuration, software versions, encryption, authentication and MFA, with results triaged by a person. We call this work a VA, plainly, and never sell it as a pentest.
03 · Web application pentest
Websites and web apps tested against the OWASP Web Security Testing Guide and OWASP Top 10: authentication, access control, session handling, input handling and business logic.
04 · Mobile app and API pentest
iOS and Android apps tested against OWASP MASVS and MASTG, and APIs against the OWASP API Security Top 10, including authentication, object-level authorization and data in transit.
05 · Network and infrastructure
External and internal network testing within the agreed scope: internet-facing services, firewalls, VPN, Wi-Fi and servers, following NIST SP 800-115.
06 · Report and retest
A Thai and English report with an executive summary and technical detail for every finding: severity, evidence, reproduction steps and the fix. Once you have fixed the issues, we retest to confirm.
07 · Remediation and ongoing care
TecTony's development team can fix vulnerabilities in the web, app or systems we look after, and set up recurring security health checks for systems that change often.
How we test, in ways you can check
- No work starts until the authorization, the scope agreement and the data-processing agreement are all signed
- Methods follow published standards: OWASP WSTG, OWASP MASVS and MASTG, OWASP API Security Top 10 and NIST SP 800-115
- Every reported finding is confirmed by a person, with evidence and a severity rating; no raw scanner output
- AI-assisted analysis runs on our own hardware (NVIDIA DGX Spark), so test data is not sent to an outside AI provider
- Test evidence is encrypted in delivery and deleted on the schedule agreed in the contract
- Where a regulator requires an independent tester with a specific certification, we name the tester and the certification in the quotation before work starts
What the law requires, and what we will not oversell
Thailand's Computer Crime Act B.E. 2550 (2007, amended 2017), sections 5 and 7, make unauthorized access to a protected system or data an offence, and sections 8–10 cover interception, alteration and disruption. A penetration test is lawful only when the system owner has authorized it in writing beforehand. We never scan or test anyone's system to "show them a weakness" before proposing work.
A pentest is a point-in-time assessment within an agreed scope. It reduces risk, but no tester can guarantee finding every vulnerability or that a system will never be attacked, and our report is evidence for an audit, not a certification.
Be wary of automated scan results sold as a cheap "pentest". If a quote has no manual testing step, no proof of access and no retest, the work is a VA, not a PT. A VA is useful, but it should be bought under its own name and at its own price.
Fees are quoted to the real scope only: the number of systems, pages and endpoints, the type of testing and the available test windows. This page lists no fixed price. Contact us to discuss scope and receive a quote.
Law and reference standards checked: 8 November 2026
Penetration testing questions, answered
What is a pentest?
A pentest (penetration test) is an authorized, scoped simulation of an attack on your own systems, to prove which weaknesses can really be exploited and what the business impact would be. An automated scan can only say where risk might exist.
What is VAPT, and how do VA and PT differ?
A VA (vulnerability assessment) is a broad, tool-driven review of possible weaknesses. A PT (penetration test) is manual testing that confirms what can really be exploited. VAPT is both together, for coverage and evidence.
Why do pentest prices vary so much?
Because many services sold as a "pentest" are only automated scan results (a VA). Check whether the quote includes manual testing, evidence for each finding, a named person responsible for the report, and a retest after fixes. If not, the work is a VA.
Is penetration testing legal in Thailand?
Yes, when the system owner authorizes it in writing before testing starts. The Computer Crime Act B.E. 2550, sections 5 and 7, makes unauthorized access to a system or data an offence, so someone with authority signs the authorization and scope agreement before we touch any system. Systems hosted by another provider may need that provider's permission too.
How much does a pentest cost?
There is no fixed price. It depends on the number of systems, pages or endpoints, the type of testing (web, app, API or network) and the available test windows. We agree the scope first, then send a written quote that states what is and is not included.
What do we need to prepare before a pentest?
Someone with authority to sign the authorization, a list of in-scope systems and URLs, test windows, test accounts separate from real users, an emergency contact, and a backup taken before testing. On a live system, agree a window that affects users least.
What do we receive after a pentest?
A Thai and English report with an executive summary and technical detail for every finding: severity, evidence, reproduction steps and the fix. Once you have fixed the issues, we retest to confirm they are closed.
Will a pentest make our system 100% secure?
No one can guarantee that. A pentest is a point-in-time assessment within an agreed scope. It reduces risk, but changing systems and new vulnerabilities need regular retesting, so we recommend a retest after any significant change.
How does TecTony use AI in testing, and where does our data go?
AI helps triage, summarise and draft the report on our own hardware (NVIDIA DGX Spark), so test data is not sent to an outside AI provider. People make the decisions and confirm every reported finding, and only on systems we are authorized to test.
Can a government agency or local authority hire TecTony for a pentest?
Yes, through procurement under the Public Procurement and Supplies Administration Act B.E. 2560, using the procurement method the Act and its regulations prescribe for the engagement, with a written authorization and a PDPA data-processing agreement in place before testing. We never test an agency's system before a contract and authorization exist, and we are glad to provide information to help define the scope.
Further reading on cybersecurity
Start by scoping your systems
Tell us which systems you want tested and why: before a launch, for a customer requirement, or for PDPA. We will propose the scope, the test approach and the authorization documents needed.