Know where your security actually stands.
Honest guidance for growing businesses. No fearmongering. No sugar coating.
Four ways in. One path forward.
Pick the line that sounds most like you. We'll show you where to begin.
Four services. One standard of honesty.
Honest.
No sugar coating about your posture, your risks, or your budget. Just what's true, and what it will actually take.
Relentless.
We help meaningfully where it counts, not by overworking but by maximising the value of every effort.
This venture was born from a simple belief: clarity matters, especially in complex environments. Technical proficiency alone doesn't create lasting impact. Genuine partnership does.Darishini (Darsh) Manimaran — Founder
Founder · Chair, CSA Malaysia
Three consultants. One standard.
Go further, where it matters.
Layer these onto any engagement, delivered by specialists matched to the work.
Agentic AI Security
As AI agents start making decisions and taking action inside your business, someone needs to ask what they can access and what happens if they get it wrong. We review and govern agentic AI workflows before that becomes an incident.
End-to-End Compliance Implementation
Full implementation support across ISO 27001:2022, SOC 2 Type 2, PCI DSS and more, carried out by certified specialists matched to the standard you actually need, not a single rigid checklist.
Let's drive your business to success.
Your first consultation is free, and comes with a 2-page risk report on where you stand.
The people behind the guidance.
Our consultants are well experienced. We give clear advice, no sugar coating.
Capability backed by credentials.
Our team's judgement is the product. Every consultant at Cyficient is selected for demonstrated depth in their field, real-world implementation experience, and certifications that validate that expertise independently.
We work with practitioners who have held hands-on operational roles, not just advisory ones. When we assess your posture, build your programme, or sit at your leadership table, we draw on direct experience of having done that work from the inside.
Our consultants have worked across banking, fintech, telecommunications, e-commerce, and enterprise IT. Their credentials span ISO 27001, SOC 2, professional technology accreditation and GRC, with decades of combined operational experience.
We maintain a deliberate, focused team rather than a large bench of generalists. Accountability matters more to us than scale. You will always know who is on your account before any engagement begins.
Four services. One standard of honesty.
Simple steps. No surprises.
Every engagement starts the same way, regardless of service: an honest conversation about what you actually need and what it will take.
From first conversation to ongoing relationship.
Five steps apply to every Cyficient engagement. The detail inside each step depends on which service you choose.
What happens inside each engagement.
Straight answers, no sales pitch.
If your question isn't here, send us a message. We're here to help.
Do we need to get certified to work with you?
No. Certification is optional. We build your security programme around what your business actually needs, whether that's real protection, client credibility, or audit readiness. If a certificate becomes relevant later, we can support that, but it's never the starting point.
We're a small team. Is this relevant for us?
Yes, and the earlier the better. Security problems don't wait for companies to grow, and enterprise clients, tenders and serious vendors will ask about your posture regardless of size. Building the foundation early costs far less than fixing a breach or losing a contract later.
Is Human Risk & Culture Management just awareness training?
No. Awareness training is one tool within it. We start by understanding where your people are most exposed and how they work, then combine simulations, role-based training, leadership sessions and regular communication. Success is measured by changes in behaviour, not by how many people completed a module.
Your data, handled honestly.
What we collect when you contact us, why, where it goes, and the rights you have over it. Written to meet Malaysia's Personal Data Protection Act 2010 (as amended in 2024) and the EU General Data Protection Regulation.
01Who we are
Cyficient Consulting is the data controller responsible for personal data collected through cyficient.net. In this policy, "we", "us" and "our" mean Cyficient.
This policy applies to this website and to the free consultation request form. It does not cover client engagements, which are governed by the data protection terms in each engagement agreement.
02What we collect
Information you give us. When you request a consultation, we collect your name, work email, company, country, preferred meeting format, the option you chose to describe your security status, and anything you choose to write in the message field. We also record that you gave consent and when.
Information collected automatically. Our hosting and security provider, Cloudflare, processes your IP address and basic technical information (such as browser type) to deliver the site, block abuse and run the bot check on our form. With your consent, we also use Google Analytics to understand how visitors use the site, such as which pages are viewed, roughly where visitors are and what device they use. It sets cookies (named _ga) only after you click Accept, and Google receives your IP address in shortened form. We do not use advertising cookies, and we never use analytics data to identify you.
Information stored on your device. We store two small items in your browser's local storage: one so the welcome pop-up does not appear on every visit, and one that remembers your cookie choice. Neither contains personal information. You can change your cookie choice at any time using Cookie settings at the bottom of every page.
Please do not include sensitive personal data, such as health or financial details, in the message field. We do not need it to prepare your consultation.
03Why we use it, and on what basis
We will not send you marketing unless you separately ask to receive it. We do not sell personal data, and we do not use it for automated decision-making or profiling.
Providing your details is voluntary. Without your name, email and company, however, we cannot respond to your request.
05International transfers
Some of our service providers process data outside Malaysia and outside the European Economic Area, including in the United States. When data leaves Malaysia, we transfer it only where the destination has a law substantially similar to the PDPA or ensures an equivalent level of protection, or where another safeguard permitted under the Act applies.
For data subject to the GDPR, transfers rely on an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
06How long we keep it
If your enquiry does not lead to an engagement, we delete your details 12 months after our last contact with you. If you become a client, we keep your information for as long as the engagement agreement and applicable law require. Security logs held by Cloudflare are kept only for short periods under Cloudflare's own retention schedule.
07How we protect it
The site is served only over encrypted connections (HTTPS with HSTS) and uses strict security headers. The form is protected against bots, validated on our server, and sent directly to our inbox without being stored in a third-party form tool. Access to enquiries is limited to the people who need it.
If a personal data breach occurs, we will notify the Personal Data Protection Commissioner and affected individuals as the PDPA requires, and, for data covered by the GDPR, the relevant supervisory authority within 72 hours where required, and affected individuals where the risk to them is high.
08Your rights
Depending on where you are, you have the right to:
To exercise any of these rights, email darsh@cyficient.net with the subject "Personal data request". We may need to verify your identity first. We respond to access requests under the PDPA within 21 days, and to requests under the GDPR within one month. Requests are free unless they are clearly unfounded or excessive.
09Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to a regulator. In Malaysia, that is the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi). In the EU or EEA, it is the data protection authority in the country where you live or work, or where the issue occurred.
10Other details
Children. This website and our services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect children's data.
Changes. We will update this page when our practices or the law change, and revise the date at the top. Significant changes will be highlighted on the website.