About
I'm SabunMacTavish, better known IRL as Tommy. I do hands-on security work, think like the adversary, and have little patience for ceremony. This blog covers technical security, the collision of AI and security, and running security from first principles.
The only measure that matters is whether a real attacker gets in. Everything else is a proxy, and most proxies are wrong.
Work
I have run security and built AI governance inside two regulated financial institutions, at very different scales. One was a US fintech answering to state regulators and, after listing, the SEC. The other was a Malaysian licensed bank on the bank side of Bank Negara's RMiT. Before either, I spent years on the other side of the table, running red team and penetration test engagements against Malaysian government entities.
MoneyLion. Head of Cybersecurity. I joined around 2018, when it was a fintech with about 2 million users, and ran security through hypergrowth to a NYSE listing in 2021 at a US$2.4 billion valuation. The company went on to serve over 20 million customers and was acquired by Gen Digital for US$1 billion in 2025. It was AI-literate before that was fashionable: machine learning sat in the credit and product stack from early on, so securing the models and the data behind them was part of the job long before anyone called it AI security.
Ryt Bank. Head of Cybersecurity, SRE and QA. A licensed digital bank backed by YTL and Sea that bills itself as the world's first AI-powered bank. Their claim, not mine, but the substance is real: an LLM-driven assistant that executes transactions and pays bills on the customer's behalf. I secured that, from the model layer down to the ledger. Internally the workforce was just as AI-heavy, with LLMs embedded in day-to-day productivity across the bank, and I took both through regulatory scrutiny. The bank launched in August 2025, passed 1.2 million customers and 25 million transactions in its first seven months, and is now Malaysia's largest digital bank.
Today I run 4rthur, doing AI-native offensive security for exactly these kinds of institutions.
Projects
- 4rthur — AI-native offensive security. Pentest and red team with proprietary AI tooling.
- u9up — Independent AI security community in Malaysia. We break it, fix it, write about it.
- SherpaSec — Volunteer-run Malaysian cybersecurity community building a sustainable ecosystem.