Haliviq

Secure by Design
Not by Accident

Haliviq tests your applications, APIs and infrastructure the way an attacker would, then helps your team fix what we find and build the habits that stop the same problems returning. We run security assessments and penetration tests, design access control and secrets handling into your architecture, and prepare you for SOC 2, ISO 27001 and PDPA reviews, written up in plain language your developers and executives can both act on.

Get Started

We help organisations find and fix security weaknesses before attackers do, and we change how software is built so fewer weaknesses get in at all. The work covers architecture reviews, penetration testing, vulnerability management, identity and access design, and hands-on support for SOC 2, ISO 27001 and GDPR, alongside PDPA in Thailand. We treat these as engineering tasks that run through every sprint, not as an audit exercise once a year. Our clients are typically product teams in fintech, healthcare and e-commerce that handle customer data and need to show buyers and regulators that it is protected.

Capabilities

Key Capabilities

Concrete capabilities we bring to this engagement — not buzzwords.

Security Assessments

Architecture and cloud-configuration reviews, with a threat model for what you actually protect and risks ranked by business impact, not by scanner score.

Penetration Testing

Manual testing of web apps, mobile apps, APIs and infrastructure. Each finding includes reproduction steps and a suggested fix, and we retest once your team has patched.

Compliance Readiness

Gap analysis and working controls for SOC 2, ISO 27001, GDPR and PDPA, with the evidence auditors ask for, not just policy documents.

Incident Readiness

Playbooks that name who does what in the first hour, plus a tabletop exercise so your team has practised before a real attack.

Identity & Access

Least-privilege IAM, single sign-on, multi-factor authentication and regular access reviews designed into the architecture.

Secrets Management

Keys and passwords moved into a vault with rotation and audit logs, and dependency scanning in the pipeline to block vulnerable libraries.

Tools We Use

Technologies We Use

Proven security tools and practices we apply where they fit — chosen for the threat model, not the trend cycle.

SIEMWAFIAMZero TrustSOARVaultSnyk

How We Work

Our Approach

A clear path from assessment to continuous readiness — adjusted per system, never one-size-fits-all.

01

Assess

Inventory of assets, current posture and a threat model

02

Plan

Chosen controls and a remediation roadmap with owners

03

Implement

Hardening, fixes and secure delivery practices

04

Monitor

Detection, alerts and scheduled retests

05

Respond

Containment, recovery and communication

06

Improve

Lessons fed back into the SDLC

FAQ

Straight answers about how we handle security.

Security assessments, secure-by-design engineering, and compliance support for product teams: threat modeling, hardening, identity and access management, and monitoring with SIEM and SOAR tooling. We treat security as engineering work integrated into delivery, not a once-a-year audit exercise.

Yes. We conduct comprehensive assessments covering code, infrastructure, dependencies, and access controls, delivering prioritized, actionable remediation rather than a lengthy report that sits unread. You get a ranked list of what to fix first and why it matters.

Yes. We support PDPA compliance in Thailand as a founding partner of PDPA.org, and we build controls that align with GDPR and ISO 27001 where your business needs them — practical implementation, not just policy documents.

Zero trust principles, least-privilege access, secrets management with tools like Vault, and dependency scanning with Snyk are built into our engineering process from the first sprint, not added as a security review before launch.

A focused assessment of one application or system typically starts in the high five figures (THB), scaling with the number of systems in scope and depth of testing required. A full SOC 2 or ISO 27001 readiness program, including control implementation, is quoted after an initial scoping call based on your current gaps.

A focused penetration test of a single application typically takes 1-2 weeks including the report and remediation guidance. A comprehensive assessment across app, API, and infrastructure for a larger system usually runs 3-5 weeks.

We flag critical findings immediately rather than waiting for the final report, so your team can start remediation the same day. Our report includes reproduction steps and concrete fix guidance, not just a severity score.

Both, depending on what you need. A point-in-time assessment gives you a snapshot and a fix list; ongoing monitoring with SIEM and SOAR tooling plus periodic re-testing keeps your posture current as your systems and the threat landscape change.

Have a project in mind?

We'd love to hear what you're building.

Start a Conversationinfo@haliviq.com