This is the story of how we left stable careers to become founders with zero outside funding.
There was no investor deck with a hockey-stick chart on slide nine. No guarantee that the market would agree with us. Just four people who saw the window beginning to close, took a leap of faith and decided to build what we believed the industry needed.
You only live once.
The Problem
This is the first post in a series about how 4rthur came to life. We begin with the problem because every startup must solve one. In this post, we share the challenges we see in the current offensive-security industry and why we believe the existing model no longer works.
Supply side: man-day billing
For years, penetration testing has been priced by man-days — the estimated time needed for an assessment multiplied by a daily rate.
On paper, it sounds reasonable. In practice, it often isn't.
Give the same application with 150 endpoints to different security firms, and you might receive estimates anywhere from three to seven days. Most clients don't know why. Without a clear breakdown of what those extra days deliver, it's difficult to compare quotes or understand the value behind them.
Attackers don't stop when the clock runs out. They stop when they find what they need.
This creates a misalignment: man-day pricing rewards time spent, not outcomes achieved. The issue isn't the skills or dedication of pentesters; it's a pricing model that limits exploration once the allocated time is exhausted.
Demand side: no one cares?
A state parking app recently went offline, affecting millions of users. Councils had to suspend parking summonses because people couldn't pay through the app. Attackers later claimed they had gained full access to the system and database.
The attack wasn't sophisticated. It exploited a well-known security flaw that a proper review should have caught. Reports suggested warnings were raised beforehand but ignored — the system simply stopped being secured after launch.
The bigger question isn't how the breach happened, but why it was allowed to happen. The vendor delivered a working app and was paid for it. Security wasn't measured, rewarded, or expected.
Too often, cybersecurity becomes a compliance exercise: one assessment a year, the lowest bidder, a fixed fee, and a report that sits unread until the next audit.
Malaysia has no shortage of security talent. The missing piece is making cybersecurity a priority across the entire ecosystem — from public agencies to businesses, buyers, and vendors. When security becomes an afterthought, the impact eventually affects everyone.
Supply Side: The Human Bottleneck
AI has accelerated software development like never before. Applications are being built faster, with teams now shipping hundreds or thousands of code changes daily. But securing this software requires testing just as extensively. Humans simply cannot keep pace with the scale and speed of modern development.
People are constrained by time, attention, and fatigue. AI agents are not. They work around the clock, launch hundreds of parallel workers, and systematically execute thousands of test cases with speed and consistency. What is exceptional for a human is routine for AI.
This is also why most security assessments are still performed annually or quarterly. Human-driven assessments are too expensive and time-consuming to run continuously. But in an environment where software changes daily or even hourly, quarterly or annual testing is no longer sufficient.
The role of humans in this ecosystem needs to change. Our comparative advantage is no longer repetitive execution, but strategic planning, critical judgment, and review. Once objectives, context, and guardrails are defined, AI agents can execute assessments faster, more consistently, and at a scale humans cannot match.
Demand side: ticking the compliance checkbox
Cybersecurity has the same challenge as insurance: its value is often invisible until something goes wrong. When budgets are tight, it's easier to justify spending on initiatives that drive revenue or growth than on preventing an uncertain future risk.
When security assessments demonstrate clear, measurable impact, organisations do care. The real problem is that the market has normalised checkbox compliance. To fit tight budgets, many providers compromise the depth and quality of their assessments, delivering just enough for clients to satisfy compliance requirements.
Low-bar compliance isn't just a demand-side problem. It's also a supply-side problem. The demand for checkbox compliance exists because the industry continues to supply checkbox security.
The Claim of Fully Autonomous Solutions
If humans slow things down, why not eliminate the human element altogether and use a fully autonomous SaaS solution?
Our answer: no. We don't believe fully autonomous security testing is the right approach, for two reasons.
First, AI still needs human oversight. AI is incredibly capable, but it isn't infallible. It can misunderstand context, miss important issues, or report findings that aren't actually vulnerabilities. Human review throughout the assessment — from planning and testing to validating results and writing the final report — helps ensure the findings are accurate and useful.
Second, security still needs people. Even if AI finds every vulnerability, someone still needs to review the results, prioritise fixes, and work with engineering teams to get them resolved. Most organisations don't need a full security team, but they do benefit from an experienced professional overseeing regular AI-assisted assessments.
To Be Continued
This concludes the first post in our founding story series. We began with the problems we see in today's cybersecurity industry.
In the coming weeks, we'll share the solutions we're building, real-world case studies, and how AI is reshaping offensive security.
We're just getting started.