Donavan Cheah

Security for complex systems, from design to decision

I lead product security and threat modeling work across complex systems, including AI-enabled products. I help teams turn attacker thinking into better architecture, stronger controls and clearer risk decisions.

My career began in penetration testing and now spans security architecture, risk and policy. I wrote The AI-Cyber Loop for business professionals navigating the overlap between AI and cybersecurity.

Product Security · Threat Modeling · AI Security · Cyber Risk

Portrait of Donavan Cheah

How I approach security

I started in cybersecurity as a penetration tester in 2016. Understanding how attackers find a way into systems taught me to ask a question earlier in the process: what can we change in the design, testing and operation of a system before that failure becomes an incident?

My work now spans product security, threat modeling, security architecture and cyber risk. I have built threat modeling and risk assessment capability, led security assessments and owned a product security program through its proof of concept, MVP and production stages. I work across engineering and design teams to make security analysis useful to the people who build products and make decisions about them.

I studied Physics at the National University of Singapore as a Kent Ridge Scholar and completed an MSc in Cybersecurity, with a policy specialisation, at Georgia Tech. That combination of technical practice and policy study helps me connect system-level findings to organisational priorities.

International speaking and training engagements in Romania, Uzbekistan, Taiwan and Japan

Product security and threat modeling

I am a Senior Cybersecurity Consultant in Thales's Critical Information Systems business line, formerly Thales Digital Factory. I own the security program for CloudFormity, an AWS automated compliance product. From proof of concept to production, I have coordinated threat modeling, risk analysis and security requirements across infrastructure, AI, frontend and user design streams to establish a robust security baseline.

My earlier work includes leading threat and vulnerability management, conducting penetration tests and assessing cybersecurity maturity for industrial partners across Asia Pacific. I also threat model AI-enabled systems, including chatbots and recommender engines, and have applied the Cloud Security Alliance's MAESTRO framework.

Outside my work at Thales, I volunteer as a co-lead of Threat Modeling Connect Singapore, contribute research through Kinryū Labs, write for outlets including ISACA, and contribute to the Geneva Dialogue. I have also published a book on AI and cybersecurity (see below).

Selected Work

Selected projects and activities across product security, AI systems, assessments, research and education.

CloudFormity

I own product security for an AWS automated compliance solution, from proof of concept through MVP and production. I coordinate security decisions across multiple development streams and have helped establish a baseline that the product can build on as it matures.

Threat Modeling Emerging Systems

I have threat modeled chatbot-based systems and recommender engines, including work with the Cloud Security Alliance's MAESTRO framework. I am interested in connecting the resulting analysis to testing, controls and decisions teams can act on.

From Findings to Remediation

I have scoped, led or technically delivered more than 20 penetration testing engagements across sectors including aviation, homeland security and education. I have also assessed more than 30 industrial partners across Asia Pacific and helped prioritise practical improvements. Earlier in my career, I created the digitalworld.local series of deliberately vulnerable machines for VulnHub.

Defend the Breach

I led a team of three that created Defend the Breach, a role-playing experience about the decisions CISOs make under constrained budgets. Developed in three months, it reached more than 150 participants in its first year and was featured at the 2023 Operational Technology Community of Experts Panel.

Kinryū Labs

I am a founding member and Principal Researcher at Kinryū Labs. Our independent team researches satellite security and threat intelligence, with work presented at CYSAT Asia and DefCamp.

Threat Modeling Connect Singapore

I volunteer as a chapter co-lead of Threat Modeling Connect Singapore, helping practitioners share methods and work together across chapters through events and hackathon mentoring.

Speaking & Training

I have delivered talks and training in Singapore and internationally, including DEFCON (Singapore), DefCamp (Romania), SECCON (Japan), SINCON (Singapore) and Global Cybersecurity Camp (Taiwan).

Mentoring & Education

I mentor cybersecurity practitioners through MentorCruise, deliver workshops and career talks, and encourage students to turn their work into conference, hackathon and research opportunities.

The AI-Cyber Loop: Essential Foundations for Business Leaders

The AI-Cyber Loop

Essential Foundations for Business Leaders

How does AI change cybersecurity, and how does cybersecurity shape the way organisations use AI? I wrote The AI-Cyber Loop to give business professionals a foundation in both subjects and to explore where they meet. Through case studies and discussion questions, it helps readers examine the choices facing attackers, defenders and decision makers.

The book is published by Business Expert Press.

Donavan Cheah participating in the ASEAN-India Youth Summit

Beyond Cybersecurity

I also contribute to community education, youth development, sustainability and neurodiversity advocacy. These activities include mentoring early career professionals, supporting cybersecurity learning communities and volunteering on projects that matter to me in Singapore and beyond.

My public-service and community work has included participation in the 5th ASEAN-India Youth Summit, work with the PAP Climate Action Group, volunteering with Halogen's Network for Teaching Entrepreneurship, and long-running support for Hair for Hope.

I have also spoken publicly about neurodiversity and Asperger's awareness, including participation in the Purple Parade and school mental-health events.

“We must do justice to the abilities we have been given.”

Speaking, collaboration or security leadership

I welcome conversations about product security, threat modeling, AI security, speaking, research and leadership opportunities. Connect with me on LinkedIn or use the contact form.

Open Contact Form

Opens in a new tab.