Location · Colombo, Sri Lanka
Application security consulting from Colombo, on site by default
I am based in Colombo, so Sri Lankan banks, insurers, telcos and groups get me in the room: assessing what you run, then ranking what to fix first.
- Colombo
- UTC+5:30
- South Asia
In short
I am an application security consultant based in Colombo. For Sri Lankan organisations I assess web applications, APIs (application programming interfaces), mobile apps and the controls around them, on site, then deliver a prioritised plan. My work here includes moving about 112 applications to cloud WAAP (web application and API protection) for a leading private bank and protecting about 120 for a global apparel group.
How we work together
On-site by default, remote when it is faster.
The market
What I see in Sri Lanka.
- Digital channels grew fastBanks and finance companies scaled apps and internet banking quickly, often with small AppSec teams.
- Vendor-managed platformsCore banking, ERP and many portals are run by vendors, so security depends on contracts and evidence.
- A new data protection lawThe Personal Data Protection Act puts personal data in customer apps and APIs under legal duties.
Rules you work under
The frameworks I map findings to in Sri Lanka.
Findings are written so your risk, audit and compliance teams can use them directly. This is orientation, not legal advice.
- Parliament of Sri LankaPersonal Data Protection Act, No. 9 of 2022Sri Lanka’s data protection law. Apps and APIs that hold personal data need security that matches the risk.
- Central Bank of Sri LankaRegulatory Framework on Technology Risk Management and Resilience for Licensed BanksBanking Act Directions No. 16 of 2021. The main technology risk rulebook for licensed banks, across the whole estate.
- PCI Security Standards CouncilPayment Card Industry Data Security Standard (PCI DSS) v4.0.1Applies to banks, acquirers and merchants handling card data, including their web and mobile payment flows.
- ISO and IECISO/IEC 27001:2022A common certification target here. Its secure development and testing controls reach into every application.
Sectors
Who I work with in Sri Lanka.
- BankingMobile apps, APIs and internet banking that regulators watch closely.Explore
- Fintech & paymentsWallets, payment APIs and apps that ship weekly and must stay trusted.Explore
- InsuranceCustomer and broker portals and partner APIs full of sensitive data.Explore
- TelecomsSelf-care apps, top-ups and busy edges that attract bots and floods.Explore
- Manufacturing & groupsLarge estates of sites, portals and APIs spread across business units.Explore
- GovernmentCitizen services that must stay secure, available and trusted.Explore
Services
Assessments available in Sri Lanka.
Fixed scope and a fixed fee. Every engagement ends in a prioritised plan you can take to any delivery partner.
- AppSec maturity assessmentScored baseline, gap analysis, 12–24 month roadmap, board summary
- Application architecture reviewThreat model, control coverage map, prioritised fixes
- WAAP & API protection assessmentCoverage gaps, bypass paths, migration or tuning plan
- Mobile app security assessmentMobile threat model, protection policy, MASVS test plan
- Exposure management (CTEM) assessmentPrioritisation model, validation approach, owner playbook, metrics
- Executive briefing or team workshopPlain-language risk briefing or hands-on workshop
- Fractional AppSec advisorRoadmap governance, vendor and design reviews, escalation support
Do you work on site with organisations in Colombo?
Yes. I am based in Colombo, so kick-off meetings, stakeholder interviews, evidence reviews and workshops normally happen at your office. Remote sessions fill the gaps between visits and suit teams in other cities. Visits to sites outside Colombo, such as data centres or regional offices, are agreed in the scope before work starts.
What application security work have you delivered in Sri Lanka?
Five enterprise programmes, all anonymised: about 112 applications moved to a cloud WAAP (web application and API protection) platform for a leading private bank; about 120 applications protected for a global apparel group; vulnerability management upgraded for a Tier-1 commercial bank; runtime protection in a bank’s mobile app; and WAAP logs piped into a bank’s SIEM (security information and event management) platform.
Does Sri Lanka’s Personal Data Protection Act affect application security?
Yes, indirectly. The Personal Data Protection Act, No. 9 of 2022, expects organisations to protect the personal data they process, and most of that data flows through web apps, mobile apps and APIs (application programming interfaces). Weak authorisation or unmonitored data exports become compliance problems as well as security ones. I assess the application controls; legal interpretation stays with your counsel.
Is there an independent application security consultant in Colombo?
Ravindu Fernando is a Colombo-based application security consultant who assesses web, mobile, API (application programming interface) and monitoring controls for banks and enterprises, then recommends prioritised, vendor-neutral fixes. He also heads the Application Security Business Unit at Innov8 (Pvt) Ltd. That is disclosed as one delivery option among several and is never a condition of an assessment.
Other locations