Malaysia's first offensive security firm with a published benchmark

4rthur is an AI-native offensive security firm. Our tooling is benchmarked in public, every test case is traced, and every finding is validated by a specialist.

/ Benchmark G4LAHAD found 14x more exclusive findings than the nearest competitor

Talk to us → See what we do ↓

/ AI-DRIVEN OFFENSIVE SECURITY

/ OUTCOMES, NOT MAN-DAYS

/ HUMAN-VALIDATED, FULLY TRACEABLE

/ NACSA LICENSED, 20381-02

/ The guarantee

Pay on success.

If we find nothing serious in the agreed scope, you owe us nothing. Full refund. No questions.

Full refund if no Medium, High, or Critical finding is produced.

Low-severity findings, informational issues, and hardening recommendations do not count toward the threshold.

01 · What we find

Measured, not claimed.

/ Benchmark · Sep 2026

G4LAHAD vs Strix OSS vs Shannon OSS vs Claude Code

Finding 14x more exclusive findings than the nearest candidate

G4LAHAD is our purpose-built black/grey box harness for web application assessments. All four ran on the same model against three real multi-role web apps, and every finding was verified by hand.

Read the method →

/ Exclusive findings · Medium and above

G4LAHAD42
Shannon OSS3
Claude Code1
Strix OSS0

Found by one candidate and missed by the other three, across three apps.

02 · The problem

The Malaysian pentest market is outdated.

"Checkbox" Mentality

of pentest performed is solely to satisfy annual requirements, or for audit.

Kickoff Time

0days

average kickoff session scheduling. Clients have to wait for the pentest to even start.

Man-Days Billing

0Hours

A day, that is what clients are paying for. Pentesters' time, not result.

03 · The solution

We kill the man-day.

Companies spend a lot of money on pentests and still get breached because testers ran out of billable days, not attack paths. 4rthur goes from paying under man-days to result-oriented outcomes.

The old model

Pay for hours worked

Pay for goals achieved

Constrained by human capacity, time, and fatigue.

Scales continuously with 24/7 autonomous testing capabilities.

Results may vary depending on tester expertise and conditions.

Provides consistent, repeatable testing with standardized processes.

Faster execution. Lower cost basis. Higher success rate.

04 · What we do

Our services.

/ Flagship / 01 · Penetration Testing You define the scope. We test it properly. Conventional VAPT across web apps, mobile, servers and network. Every finding validated by hand, priced by what is actually in scope and never by man-days. from RM 3,000Start a penetration test →

/ 03 AI Offensive Assessment Offensive testing of LLMs, agents, and tool-use chains. from RM 30,000 / 04 Red Teaming Objective-driven, multi-vector adversary emulation. Contact us

05 · Client portal

Every finding, in one place.

Findings, pentest reports, assessment results and engagement comms all live in ROUNDT4BLE, your client portal. Know exactly where your engagement stands, in real time, without having to ask.