Industries · Defence & National Security

Sovereign by construction, not by clause.

Kemhan, the TNI cyber commands, BSSN and the Defend ID primes are building capability that cannot depend on a supplier answerable to another government. Zentara is an Indonesian company that designs and assembles its own hardware, deploys inside your perimeter, and is structured so the capability ends up in your hands rather than on our licence.

Talk to a Defence & National Security specialist

Rp187.1T: Kemhan allocation, FY2026; Second-largest of any ministry
85%: Counter-trade, local content and offset combined; On alpalhankam bought from abroad — UU 16/2012, with a 35% local-content floor
8 pillars: National Cyber Security Strategy; Perpres 47/2023, including national cryptographic independence
29 nations: Defence Cyber Marvel 2026; Satsiber TNI exercising alongside BSSN and all three service cyber centres

What we are defending

Where the loss is not measured in downtime.

Command and control

Networks that must hold when the adversary already knows they exist. Availability is not an SLA question here; it is the difference between deciding and reacting.

PIIV — vital information infrastructure

Designated under the national strategy and defended to a standard the operator often cannot resource alone. The designation creates the obligation; it does not fund it.

Secure facilities

Rooms where the conversation is the asset. Acoustic leakage, RF emanation and implanted devices — sweeping is a schedule, not an event, because a room is only clean until someone walks in.

Cryptographic material

Perpres 47/2023 names national cryptographic independence as a pillar for a reason. Key material generated on hardware you did not build is key material you cannot fully account for.

Defence industry supply chain

Defend ID entities and their tier-two suppliers hold design data on systems in service. The prime is hardened; the machine shop with the CAD files usually is not.

Cleared personnel

The most durable access an adversary can buy. Technical controls do not address recruitment, and vetting is a process rather than a certificate.

Instrument · Obligation · Capability transferred

The policy is already written. The capability is what is missing.

Indonesian doctrine on self-reliance is not aspirational language — it is statute, presidential regulation and procurement rule. Each line below is an existing obligation and what we do to help you meet it with capability you keep.

Instrument	What it requires	What Zentara does	What you end up owning
UU 16/2012 Industri Pertahanan	Alpalhankam procured from abroad must carry counter-trade, local content and offset totalling at least 85% of value, of which local content and offset must be at least 35% — a floor that rises every five years. Industry is organised across four clusters from raw material to main equipment, and foreign supply is permitted only where domestic capability does not yet exist.	Deliver as domestic content rather than as an import wearing a local badge — design, assembly and support inside Indonesia, documented for KKIP scrutiny.	Domestic-content documentation, transferable design authority
Perpres 47/2023 Presiden RI	National Cyber Security Strategy and Cyber Crisis Management across eight pillars: governance, risk management, preparedness and resilience, PIIV protection, national cryptographic independence, capability and capacity, cyber policy, and international cooperation.	Build against the pillars your institution owns — most often PIIV protection, preparedness, and the capability pillar, where the gap is people rather than product.	Operating capability, trained personnel, exercised playbooks
PP 71/2019 Republik Indonesia	Electronic system and transaction obligations for public-scope operators, including where systems and data may be placed.	Architect and deploy so the residency question never becomes a finding — on-premise or sovereign cloud, with the data path documented rather than asserted.	Documented data path, residency evidence
RUU KKS In deliberation	The Cyber Security and Resilience Bill, a priority in the 2025–2029 national development plan. Not yet law, and it will not arrive gently.	Build to the direction of travel rather than the current floor, so the transition is a filing exercise instead of a programme.	Forward-compatible control set
UU PDP Republik Indonesia	Personal data protection obligations that apply to state bodies as much as to companies, including breach notification within 72 hours.	Governance and incident runbooks written for institutions where the notification decision crosses more than one authority.	DPIA records, cross-authority runbook
IEC 62443 International	Security for industrial automation and control systems — the standard applied to installations, plant and platform-side control networks.	Zone and conduit design and assessment for control systems where an IT-style test would be dangerous rather than merely wrong.	Zone and conduit model, assessed control set

UU 16/2012

Industri Pertahanan

Requires

Alpalhankam procured from abroad must carry counter-trade, local content and offset totalling at least 85% of value, of which local content and offset must be at least 35% — a floor that rises every five years. Industry is organised across four clusters from raw material to main equipment, and foreign supply is permitted only where domestic capability does not yet exist.

We do

Deliver as domestic content rather than as an import wearing a local badge — design, assembly and support inside Indonesia, documented for KKIP scrutiny.

What you end up owning

Domestic-content documentation, transferable design authority

Perpres 47/2023

Presiden RI

Requires

National Cyber Security Strategy and Cyber Crisis Management across eight pillars: governance, risk management, preparedness and resilience, PIIV protection, national cryptographic independence, capability and capacity, cyber policy, and international cooperation.

We do

Build against the pillars your institution owns — most often PIIV protection, preparedness, and the capability pillar, where the gap is people rather than product.

What you end up owning

Operating capability, trained personnel, exercised playbooks

PP 71/2019

Republik Indonesia

Requires

Electronic system and transaction obligations for public-scope operators, including where systems and data may be placed.

We do

Architect and deploy so the residency question never becomes a finding — on-premise or sovereign cloud, with the data path documented rather than asserted.

What you end up owning

Documented data path, residency evidence

RUU KKS

In deliberation

Requires

The Cyber Security and Resilience Bill, a priority in the 2025–2029 national development plan. Not yet law, and it will not arrive gently.

We do

Build to the direction of travel rather than the current floor, so the transition is a filing exercise instead of a programme.

What you end up owning

Forward-compatible control set

UU PDP

Republik Indonesia

Requires

Personal data protection obligations that apply to state bodies as much as to companies, including breach notification within 72 hours.

We do

Governance and incident runbooks written for institutions where the notification decision crosses more than one authority.

What you end up owning

DPIA records, cross-authority runbook

IEC 62443

International

Requires

Security for industrial automation and control systems — the standard applied to installations, plant and platform-side control networks.

We do

Zone and conduit design and assessment for control systems where an IT-style test would be dangerous rather than merely wrong.

What you end up owning

Zone and conduit model, assessed control set

Kemandirian · The measure that matters

Ask where the capability lives, not who signed the contract.

Every vendor will write sovereignty into a proposal. The question worth asking is structural: if the supplier's home government instructed it to stop, what would stop? A licence that can be revoked, a support contract that can lapse, a firmware update that can be withheld, and key material generated on hardware built elsewhere are all dependencies no clause repairs. Indonesian doctrine already answers this — UU 16/2012 forces local content and offset into every foreign alpalhankam purchase, and Perpres 47/2023 names cryptographic independence as a national pillar. The ladder below is simply that policy expressed as something you can audit a supplier against, including us.

Dependency ladder

1
Foreign owned, foreign operated
Service delivered from abroad. Continuity depends on a relationship between two governments.
2
Foreign owned, locally staffed
People are here; the licence, the roadmap and the kill switch are not.
3
Local integrator, foreign core
An Indonesian contract wrapped around imported technology. Domestic content on paper.
4
Indonesian built and operated
Designed, assembled and supported here, under Indonesian law and Indonesian jurisdiction only.
5
Transferred to the institution
Your personnel run it. The supplier could disappear and the capability would not.

Highlighted: where a capability must sit before it can be relied on in a contested environment.

Framing derived from UU 16/2012 and Perpres 47/2023

Sector threat model

State-sponsored intrusion with the patience to wait years and the budget not to be noticed
Acoustic, RF and optical surveillance of command facilities, ministerial offices and negotiation rooms
Supply-chain compromise reaching alpalhankam through a component nobody specified directly
Compelled access — a foreign vendor obliged by its own government to act against your interest
Insider recruitment and coercion targeting cleared personnel and their families
Pre-positioning inside vital information infrastructure, held quiet until it is useful

What this sector answers to

The regulatory landscape for defence & national security. Our own accreditations are listed on certifications.

UU 16/2012Perpres 47/2023PP 71/2019UU PDPBSSNIEC 62443ISO 27001

Track record

Secure data centre design for Indonesian military commands, counter-surveillance hardening for government facilities, and sovereign hardware designed and assembled in Indonesia.

For foreign primes with an Indonesian obligation

Your offset requirement is our core business.

UU 16/2012 requires counter-trade, local content and offset totalling at least 85% of value on alpalhankam bought from abroad, with local content and offset making up at least 35%. That makes an Indonesian partner a condition of the sale rather than a courtesy. Most foreign primes discover this late and treat it as a compliance cost. Handled properly it is the part of the bid that wins.

Cyber and counter-surveillance scope that counts as genuine domestic content, not a subcontract that fails scrutiny at KKIP.
Technology transfer we can actually absorb — we hold design authority on our own hardware, so a transfer arrives somewhere capable of receiving it.
Documentation in Bahasa Indonesia for the customer and English for your programme office, prepared as one deliverable rather than two.
We work as your partner in-country without asking for the parts of your programme you cannot share, which is usually the reason these arrangements stall.

Before you have to justify us internally

Bringing in a security vendor is itself a risk you have to evidence.

So here is the answer to the questions your risk committee will ask, before they ask them.

No foreign export licence governs what we may sell you

We are PT Mars Bumi Indonesia. There is no third country whose export-control authority sits between your requirement and our ability to meet it, and no foreign ministry that can instruct us to stop.

We build the hardware

GT-ZERO, GT-LONG, M5P and M7 are designed and assembled by us, not badged. That is the difference between domestic content under UU 16/2012 and an import with an Indonesian invoice.

Air-gapped by default; nothing calls home

Deployments in classified environments carry no telemetry channel, no licence check and no update path we control. If it needs to be sealed, it is sealed.

Indonesian nationals, named and vetted

Personnel on sensitive programmes are Indonesian citizens, named to you in advance, with vetting appropriate to the environment. Access is scoped to the engagement and ends with it.

We do not ask what you are protecting

Engagements are scoped against effect rather than content. You do not have to declassify a requirement in order to procure against it, and we design assuming we are not told everything.

Transfer is the objective, not the upsell

Build-operate-transfer is how we prefer to work. A capability your people cannot run without us is a dependency, and dependency is the thing this whole sector exists to remove.

Recommended

Solutions for Defence & National Security

Secure Data Center Design

TSCM — Technical Surveillance Countermeasures

Counter-Surveillance Hardening

GT-ZERO — acoustic protection

Critical Infrastructure & SCADA/OT Protection

Turnkey SOC — build, operate, transfer

Red Team Operations

Cyber Threat Research & Executive Briefings

Corporate & Insider Investigations

VAPT & Offensive Security

Penetration testing for Defence & National Security

23 services in the catalog apply to Defence & National Security — from point-in-time pentests to red team and continuous validation.

Explore all 23

Penetration Test

External Network Penetration Test

Black-box test of internet-facing assets, perimeter exposure, and exploitable services.

Penetration Test

Internal Network Penetration Test

Assumed-breach lateral movement, AD abuse, sensitive data discovery from inside.

Penetration Test

Active Directory / Entra ID Security Assessment

Kerberoasting, AS-REP, ACL abuse, BloodHound paths, hybrid identity review.

Assessment

Firewall, Router & Switch Configuration Review

Rule base hygiene, ACL drift, hardening against CIS Benchmarks.

Penetration Test

VPN Security Assessment

IKE/IPsec, SSL VPN, split tunneling, ZTNA migration readiness.

Assessment

Email & DNS Security Review

SPF/DKIM/DMARC, MTA-STS, DNSSEC, BIMI, phishing surface.

Penetration Test

Web Application Penetration Test

OWASP Top 10, business logic, authenticated/unauthenticated flows.

Assessment

Secure Code Review (Manual + SAST)

Manual review of critical flows + SAST tooling for OWASP/CWE coverage.

What we have written about it

Our own analysis, published.

All articles

State-Sponsored APTs in Asia: Tactics, Techniques, and Defence Strategies

As the landscape of cyber threat intelligence in Asia evolves, state-sponsored advanced persistent threats (APTs) pose a growing risk to regional enterprises. These attacks are typically highly targeted, well-resourced, and designed to remain undetected for extended periods. Unlike opportunistic cyb

Proactive Threat Hunting: Moving Beyond Automated Alerts to Find Hidden Adversaries

Security teams today are flooded with alerts. SIEM, EDR, NDR, and cloud security tools generate thousands of notifications every day. A 2023 report by Palo Alto Networks found that SOC teams receive an average of 11,000 security alerts daily, making it difficult to distinguish real threats from nois

The Rise of Autonomous Cyber Attacks: When AI Becomes the Adversary

Artificial intelligence is reshaping cybersecurity at an unprecedented pace. While organisations adopt AI to strengthen defence, attackers are using the same technology to automate, accelerate, and scale their operations. Cyber attacks are no longer limited by human speed or manual effort. We are en

Securing defence & national security?

Start with a scored maturity baseline or go straight to a specialist conversation.

Talk to a Defence & National Security specialist Take the 5-Minute Cyber Maturity Assessment