About Zentara
When we do our work well, nothing happens.
Quietly, on purpose. That is the nature of protection — and it leaves a company like ours with an awkward problem. If success is invisible, how should anyone judge us?
Not by the incidents you never had. By the work underneath them. This page is that work, written down.
We protect institutions that cannot afford to fail.
Banks. Government bodies. Enterprises whose worst day becomes a national headline.
When we get it right, nothing happens and nobody notices. When we get it wrong, the cost is not paid by us. It is paid by people who never met us — a client's customers, a citizen's data, a board's standing on a morning it did not expect.
That is the work. It does not forgive ordinary effort.
“Clients hand us the keys to the things they cannot afford to lose. How we use that access when no one is watching is the truest test of this culture.”
The Z Culture · internal
We kept seeing the same failure.
Zentara was founded on 16 April 2025 — not because Indonesia lacked security technology. It had access to the same platforms as everyone else. What kept repeating was structural, and it showed up in three ways.
Critical systems defended by tools chosen in another country, tuned for another threat model, and supported from another time zone. When something moved at 3am Jakarta time, the people who understood the platform were asleep.
Vendors who deployed and left. Six months later a regulator asks a specific question about a specific control, and nobody still on the account can answer it — because nobody still on the account designed it.
A generation of Indonesian engineers with the aptitude for this work and nowhere legal, free, or genuinely difficult to learn it. The talent was never the constraint. Access was.
None of it needed new technology. It needed someone accountable, and present.
So we built one. Zentara is headquartered in Greater Jakarta because that is where the institutions are, where the regulators are, and where 3am is 3am for us too.
We are younger than most of the systems we defend.
The company is. The people are not — the certifications, the incident hours and the scars arrived with them. What the date actually measures is how hard the first fifteen months were worked.
Apr 2025
Founded
60+
Specialists hired
2
Company-level ISO certifications earned
6
Platforms engineered in-house
You cannot be accountable for a system you did not design.
The straightforward business was always available: licence somebody else's platform, mark it up, install it, invoice. Most of this industry runs that way.
We took the harder route and built our own. It means when a detection misses, the people who wrote the rule are in the building. When a regulator asks how a control works, the answer comes from the engineer who designed it rather than a support queue in another hemisphere.
It also means we can say no to our own products. Vendor-agnostic is easy to claim when you have nothing to lose by it.
Built in-house
- ZXSIEM platform
- AVASVulnerability assessment
- RaksaBug bounty & VDP
- ZEN iNTELThreat intelligence
- IRISImage recognition & identification
- GT · M7Counter-surveillance hardware
The work no one sees is the work that protects.
Nobody is impressed by a well-written configuration. No client has ever asked to see the log retention policy, the test that covers the edge case, or the runbook a stranger could pick up at 4am.
That layer is the protection. Everything visible sits on top of it. So it gets the highest standard we have — not the standard the audience would notice, because there is no audience.
A quiet flaw is a future breach. In the protective layer, “good enough” does not exist.
# Why this rule exists, for whoever inherits it. # # Fires on service-account auth from a subnet the account # has no operational reason to reach. Tuned against 90 days # of the client's own baseline, not a vendor default — # their batch window legitimately looks like exfiltration. # # Known blind spot: misses if the operator already holds a # valid Kerberos ticket. Covered by DET-0442. If you remove # that rule, this one stops being sufficient. # # Reviewed 12 Jun 2026 · owner: blue team
Illustrative — client detections are never published
That is one of them. There are four more on this page.
Underneath the writing above, this page carries the layer it argues for — the escalation clock, the changelog, the review scorecard, the control mapping. Pull the surface back with the control at the bottom of your screen, and read what is normally never shown to anyone outside the work.
Values are not words. They are decisions.
Enron's lobby listed four values in marble: integrity, communication, respect, excellence. The company was a fraud. The marble meant nothing.
The real values of any company are never the words on the wall. They are the behaviours it rewards, the people it promotes, the work it pays for, and the people it lets go.
So ours are written to be lived, not admired. If a value is not visible in someone's actual work, it does not count.
Two consequences we will state plainly. We pay above market — a fact, not a promise, because one careless teammate is not a small problem on this kind of mission. And we punish carelessness, never courage: a thoughtful bet that fails is the price of a company that invents. A skipped control is not.
Clarity
earns trustWe tell each other the truth, with care. Direct because we are loyal — to the person, not about them.
What true thing am I not saying, and who needs to hear it?
Judgment
makes the right callsIn our work, a wrong call is a breach. We invert first: it is easier to avoid a disaster than to chase a miracle.
How would this fail — and what would change my mind?
Craft
is the protectionSubstance over showmanship. A mile deep, not a mile wide. In the protective layer, good enough does not exist.
Would this survive a stranger's audit a year from now?
Velocity
sets the paceWe move fast and stay calm. Panic is a failure of preparation. Calm is our operating speed.
What am I delaying that I could start today?
Ownership
makes it happenYou carry the outcome. Freedom and responsibility are one thing, not two — and one is the price of the other.
What did I commit to — and is it done, or did I just hope it was?
Five divisions. One line of accountability.
Four commercial divisions and a research lab. The structure exists so that a client never has to integrate our internal boundaries — the handoff between intelligence, detection, and response happens inside Zentara, not in the client's inbox.
24/7
SOC coverage, 365 days
28
Services across eight capability groups
8
Industries served, from banking to defence
2
Offices — Greater Jakarta HQ and Singapore
Standards we did not set ourselves.
A company assessing other people's security should be willing to be assessed itself. Ours are company-level certifications covering operations, the SOC, and service delivery — not individual staff certificates presented as if they were the same thing.
ISO 27001 for information security. ISO 42001 for AI management — a pairing that holds our AI work to the same discipline as our security operations. Delivery is aligned to OJK and BSSN locally, NIST and PCI DSS internationally.
We are registered with Kominfo as a PSE. Our legal entity is PT Mars Bumi Indonesia, and our data stays where our clients need it to stay.
Verify at our trust centreCertified & compliance-aligned
Trusted by institutions
A country cannot import its own defence.
Indonesia needs more capable security people than it currently produces. That shortage is not solved by any one company hiring well — so two of the things we fund return nothing directly.
TryHards
A free, community-run Capture The Flag platform and cybersecurity collective. Free challenges, a public scoreboard, and a Discord where beginners get real answers. It does not sell anything and it is not a lead funnel. It exists because we needed somewhere like it when we were starting, and it did not exist.
Visit TryHardsResearch & policy
Zentara Labs publishes strategic research, including Indonesia's AI Future Report, which has been briefed at minister level. Where national capability is being decided, we would rather be in the room contributing evidence than reacting to the outcome afterwards.
Reports & whitepapersDeep roots. Sturdy trunk.
Everything worth having compounds — skill, trust, reputation, relationships. None of it arrives quickly. All of it arrives eventually.
The company that lasts is not the one that grows fastest. It is the one whose foundations go deepest: in the quality of its people, the honesty of its standards, and the patience of its bets.
So we are calm, and we are in a hurry. Calm, because panic is a failure of preparation, and we prepare. In a hurry, because the work matters and the world does not wait.
A team, not a family — with soul.
A family keeps you because you belong. A team keeps you because, together, you win. The standard is how we show we care.
Meet the leadershipIndonesia — Headquarters
BAIC Tower 16th Floor, Jl. Gading Serpong Boulevard Blok S No. 8, Tangerang, Banten 15810
Singapore — Regional Office
SBF Building, 160 Robinson Rd, Singapore 068914
The best security work is the work you never hear about.
Tell us what you're protecting. You'll get an engineer's answer — scope, method, and the honest constraints — not a brochure.