THJ Security attacks your applications, networks and cloud the way a real adversary would, proves it with a working exploit, and hands you the exact path to shut it down.
Services
Six services, one cycle: find, audit, fix, monitor.
Penetration testing
Web, mobile, API, internal network and Active Directory. Manual testing, proof-of-exploit, and a free re-test after remediation.
- OWASP
- PTES
- Red team
Cybersecurity risk assessment
We find your organisation's weakest points, rank them by the damage they could cause, and propose what to protect first. Aligned with the Cybersecurity Law methodology, ISO/IEC 27005 and NIST; MDDIC permit 0866.
- ISO 27005
- NIST CSF
- Permit 0866
Information security audit
ISO/IEC 27001:2022 and statutory IS audits, gap analysis and remediation plans. Gets you ready for certification. Permit 0865.
- ISO 27001
- ISO 27701
- Permit 0865
Managed security (MSSP)
Monthly external and internal vulnerability scanning, log monitoring, phishing and brand monitoring, first incident response. Turns audit findings into continuous control.
- 24/7 monitoring
- Monthly report
- Incident
Anti-fraud monitoring
Continuous monitoring of illegal gambling and fraud operators: their sites, the payment accounts they rotate through, and their Telegram channels. Every new account is recorded with evidence and a screenshot, in a console built for investigators and bank risk teams.
- 24/7 collection
- Account tracking
- Telegram
Attack surface monitoring (ASM)
We continuously scan Mongolian internet space for your exposed hosts, ports, services and .mn domains, and alert you the moment a new vulnerability or an accidentally opened system appears.
- Continuous scanning
- .mn domains
- Alerts
Why THJ
Evidence first
Every finding comes with a reproduction and proof. No template reports, no copy-pasted advice.
Proof, not theory.
- CriticalCross-tenant fund transfer via payout approval race
- HighIDOR on merchant payout endpoint
- HighSSRF in webhook validator reaches metadata service
- MediumSession fixation on SSO callback
- LowVerbose stack traces on 500s
14 findings · 2 critical · every one with a fix · retest 14/14 verified
The people behind the findings.
Three core specialists plus a network of contract researchers.
L. Ulambayar
Founder and CEO
Web/app exploitation, internal networks, Active Directory
- OSWE
- OSEP
- Haruul Zangi CTF 2023 · 2026 medallist
S. Byambadalai
Chief Technology Officer (CTO)
CTF, malware analysis, tooling, bank-side defence
- ICC 2023, 3rd worldwide
- Haruul Zangi 1st place 2021-2023
- Black Hat MEA 2025 top-10
Naran-Erdene
Lead auditor, governance
ISMS, compliance, risk management
- ISO/IEC 27001 Lead Auditor (IRCA)
- ISO/IEC 27701 Lead Auditor
- ISO/IEC 27035 · ISO 31000 Lead Manager
Method
Transparent and time-boxed from scoping to re-test.
- 01
Scope
Systems, permissions, timing and rules agreed in writing. Proposal in 48 hours.
- 02
Test
Automated plus manual testing. Critical findings reported as they are confirmed.
- 03
Report
Executive summary, technical detail, proof-of-exploit, prioritised remediation plan.
- 04
Re-test
Free verification after fixes to confirm closure.
- 05
Monitor
Optionally continue as MSSP with monthly oversight.
Contact
Describe your scope and we will reply with a proposal within 48 hours.
- Phone+976 7255 4973
- Viber+976 8080 1337
- Emailinfo@thjsecurity.tech
- 0865Information security audit permitValid → 2029-02-24
- 0866Cybersecurity risk assessment permitValid → 2029-02-24
Ministry of Digital Development, Innovation and Communications · Tergel Khurd Jiguur LLC · Reg. no. 7233465