Field notes from the frontline
Analysis on changing regulations, offensive tradecraft, and privacy trends from Pentastic's Hong Kong consultants — written for security, compliance, and product leaders. From evolving SFC and HKMA guidance to the tradecraft behind our penetration tests and red team engagements, we share what we're seeing on the ground so you can stay ahead of the threats and regulations shaping your industry.
SFC Cybersecurity Guidelines: What Hong Kong Brokers Must Do in 2026
A practical breakdown of the SFC's 20 baseline cybersecurity requirements and the gap-analysis steps internet brokers should prioritize this year.
Penetration Testing AI Chatbots: Prompt Injection, Data Leakage, and Guardrail Bypass
How modern red teams evaluate LLM-powered chatbots — from prompt injection chains to tool abuse — and what to fix before shipping to production.
Privacy Impact Assessments for AI-Enabled Applications in Hong Kong
Aligning AI product launches with the Personal Data (Privacy) Ordinance and the PCPD's guidance — a PIA scoping template for product and legal teams.
Phishing Simulations That Actually Change Behavior
Why most phishing campaigns fail to move the needle — and how to design a program that measurably reduces click-through over time.