About

Malaysia first cybersecurity awareness and digital ethics company built on Islamic values. Learn about founder Aaron Mokhtar and our mission.

Malaysia's first cybersecurity awareness and digital ethics practice built on Islamic values.

Why I started this

I kept running into the same two failures, from opposite directions.

In the corporate work, security content was written by marketers who didn't understand what they were describing. When you don't understand something, fear is the easiest thing to reach for — breach numbers, threat actor names, one click from catastrophe. It works just well enough to keep getting done. It also costs the vendor credibility with the exact engineers who decide whether to buy.

In the community work, the advice families got was either too technical to use or written for somewhere else entirely. And for Muslim families there was a third problem: the material was often culturally weightless, so it never quite landed as something that mattered.

Neither gap is complicated. Both come down to someone writing about a thing they don't know well enough to explain plainly. That's the gap I work in.

Aaron Mokhtar

I'm a certified security practitioner and a content professional of about twenty years — CISAM, Certified Information Security Awareness Manager, issued by CyberSecurity Malaysia.

I spent six years inside that agency, from 2010 to 2016, building training content and running public outreach. In 2024 they hired me back as a consultant to develop the training modules they now sell. I've written and delivered training for the Prime Minister's Department, MOSTI and Royal Malaysian Customs, and I've developed education modules for universities and schools across Malaysia.

Before, during and since, I've been writing — copy, content strategy, brand work, for enterprise and government clients. The security credential came later and it changed what I could do with the writing.

I'm Irish-Malaysian and Muslim, which is less biography than it sounds: it's why I can write for a Kuala Lumpur boardroom and a surau parenting session in the same week without either one sounding borrowed.

The name

Ihsan means excellence — doing a thing beautifully, and doing it right even when nobody is watching. It's an Islamic idea and I won't pretend otherwise, but it isn't a condition of working with me.

Applied to this work it comes out as three habits. Help before you sell. Be accurate even when inaccuracy would convert better. Behave the same way in the parts of the job a client will never inspect.

If you're a CMO at a Singaporean vendor with no interest in where the ethic comes from, that's fine — the three habits are the whole of it, and you'll get them either way.

What that's built on

The claim	The evidence
I understand security	CISAM — Certified Information Security Awareness Manager, CyberSecurity Malaysia.
The agency that certified me later hired me	Six years inside CyberSecurity Malaysia, 2010–2016. Brought back in 2024 to build the training modules they sell.
I've written for institutions that check	Training content delivered for the Prime Minister's Department, MOSTI and Royal Malaysian Customs.
I can actually write	Roughly twenty years of copywriting, content and strategy across enterprise and government.
I can hold a room	2,000+ hours of live outreach and lectures in a single year. 21 appearances on national television, radio and digital media.
I handle data properly	A published AI-use and data-handling policy — the same document I sell as a service.

Worked with

CyberSecurity Malaysia · Jabatan Perdana Menteri · MOSTI · Royal Malaysian Customs · Petronas · Microsoft · CelcomDigi · Kementerian Pendidikan Malaysia · Kementerian Pembangunan Wanita, Keluarga dan Masyarakat · Eduspec · Talian Kasih

Why there's parenting advice next to a B2B retainer

A fair question if you've clicked through the blog.

The public writing — scams, parenting, online safety for families and seniors — is the part I'd do regardless. It's the reason the practice is called what it's called.

The commercial work is content and communications for cybersecurity companies. That's the business.

They aren't separate. The blog is the live demonstration: if I can make a WhatsApp scam legible to a 65-year-old, making your product legible to a CFO isn't the hard part. Most vendors ask you to take that ability on faith. Mine is published, dated, and you can read it before you spend anything.