KUALA LUMPUR, MALAYSIA
I’m Zaid Ahmad, a penetration tester and PhD researcher. I test the systems people rely on, and study why phishing keeps reaching the people behind them.
Penetration testing, phishing research, and teaching at APU.
I lead vulnerability assessment and penetration testing at APU’s Forensics & Cybersecurity Research Centre. My work spans web applications, cloud environments, enterprise systems, and operational technology, with a background in digital forensics and security auditing.
Alongside that work, I’m pursuing a PhD in Cybersecurity at Asia Pacific University. I study repeated phishing victimization: how everyday behaviour, psychology, and the way people use their devices can affect their susceptibility to attacks.
I started asking this question after watching the same colleagues fall for near-identical phishing attempts more than once: not from carelessness, but from something more predictable in how attention and habit work under pressure. That gap between what security training assumes and how people actually behave is what my research tries to close.
I also design and teach cybersecurity modules. Moving between assessments, research, and the classroom gives me different ways to examine the same questions about security.
Published work on cybersecurity, human behaviour, and learning.
Research into the psychological factors and everyday digital behaviours associated with repeated phishing victimization.
View paper on IEEE Xplore (opens in a new tab)Co-authored work on an e-learning framework that combines education and entertainment for primary STEM learning.
View paper on IEEE Xplore (opens in a new tab)A co-authored examination of social engineering and a conceptual framework for cybersecurity awareness. Published in the Annual Review of Cybertherapy and Telemedicine, starting on page 90.
Read the journal issue (opens in a new tab)An early research paper examining well-known cyberattacks, including WannaCry, the Estonia attacks, and the Sony Pictures breach, as material for security education.
Read full paper (opens in a new tab)Links open the publisher’s page. IEEE full-text access may require an institutional subscription.
The themes connecting my research and security practice.
Human behaviour
My PhD research examines the psychological, behavioural, demographic, and device-related factors behind repeated phishing victimization, with the aim of developing preventive strategies.
Security practice
My role covers the full assessment lifecycle, including reporting findings to stakeholders and working with teams on remediation. That context informs the way I teach technical security.
Security assessments, consultation, and training for teams, businesses, and individuals.
Web, cloud, enterprise, and OT security assessments from scoping through remediation. Recent engagements include application-layer testing (SQL injection, authentication bypass, LFI, IDOR) and full digital forensic investigations.
Enquire about an assessment (opens your email app)Advisory sessions for businesses and individuals: security posture reviews, incident guidance, and phishing/human-factor risk assessment grounded in active research, not generic checklists.
Book a consultation (opens your email app)Cybersecurity awareness and technical training for students and non-technical teams. Past sessions include cybersecurity awareness workshops (SMK Taman Desa), digital forensics training (TechXperience), and security leadership training (GreenPhyto Singapore).
Enquire about training (opens your email app)Case study
Following website findings through a retest: what changed, what remained open, and why verification matters.
Read the case study (opens in a new tab)Case study
Reviewing the access paths around a cloud security control and turning configuration evidence into remediation priorities.
Read the case study (opens in a new tab)From security operations and digital forensics to research and teaching.
APU Forensics & Cybersecurity Research Centre · January 2024–present
I lead a team through assessment scoping, testing, and remediation planning across web applications, enterprise systems, and cloud environments.
Asia Pacific University · Jul 2024–Present
Research on phishing victimization, cyber awareness, and preventive strategies. Co-authored work published in IEEE and the Annual Review of Cybertherapy and Telemedicine.
Asia Pacific University · Aug 2024–Present
Design and deliver cybersecurity modules to master’s and undergraduate students.
Virtually Testing Foundation · May 2022–April 2023
I progressed from security engineering into program coordination and management, helping organise training, onboarding, and security work for an international cohort of interns.
For research collaborations, speaking opportunities, or a conversation about technical security and human behaviour, you can reach me by email or on LinkedIn.
zaid.ahmad@apu.edu.my