Penetration testing for Indonesian retail and e-commerce

An online retailer cannot wait for a fraud spike or a breach notice to find out whether its checkout, its public APIs, or its customer accounts are exploitable. The better time to find out is under a controlled test. PCI DSS makes part of this a standing obligation rather than a discretionary project: any merchant handling payment card data has to perform regular penetration testing of the cardholder data environment. This page covers what has to be in scope for a retailer or marketplace specifically, how testing adapts around checkout and loyalty systems, and what happens once the report lands. For how a penetration test works in general, see our penetration testing service page.

Why testing looks different for e-commerce

A retail attack surface is not one web application. It is a checkout, a set of payment and wallet integrations, a customer account system, and often a marketplace, each holding a different slice of what an attacker wants.

There is no single retail-specific testing mandate the way OJK sets one for banks, but the obligation exists in substance. PCI DSS requires regular penetration testing of the cardholder data environment for any merchant handling card data, and UU PDP requires controllers to apply appropriate technical measures to protect customer personal data. A penetration test is one of the more direct ways to show both hold in practice rather than only on paper.

What we test and how we deliver it

Scoping has to account for every system that touches customer money or data, not just the public storefront.

Every engagement includes a free retest once fixes are in, because a report that says "fixed" only means something if someone checks. Findings are categorised by severity and mapped to remediation timeframes you can defend, and the scope is set around your live trading windows so a test does not become the reason checkout goes down. If you are weighing a lighter-touch scan against a full test, our page on vulnerability assessment vs penetration testing sets out where each one fits, and our page on how long penetration testing takes covers what to expect on timing.

What the sector context means for retail

Retail and e-commerce sit under two regimes at once. PCI DSS governs how payment card data is handled and requires regular testing of the environment around it. UU PDP governs the customer personal data behind every account and order, expects appropriate technical measures, and sets a 72-hour breach notification clock. Large platforms also operate as electronic system operators under PP 71/2019, which carries its own security and reporting obligations. A test that is scoped to the checkout, the APIs, and the account systems is one action that speaks to all three, rather than treating each as a separate compliance exercise.

If your checkout, APIs, or loyalty systems have not been tested against what an attacker would actually try, our team can scope a test to what PCI DSS and your own risk profile require and set out a concrete next step.