Three decades of protecting Asia's most sensitive conversations.

Who we are

Risk3 was founded in Hong Kong in 1992, at a time when the region's rise as a financial centre was matched by a corresponding rise in commercial intelligence collection against the firms and families driving it. The founding premise has not changed. Companies in Asia needed countermeasures built on professional intelligence tradecraft, delivered with a private bank's discretion.

Today we serve corporate boards, general counsel, family offices, investment funds, law firms, government bodies and foreign missions across eleven jurisdictions. Our consultants are drawn from technical intelligence, counter-intelligence, digital forensics and investigative backgrounds, and operate under strict confidentiality obligations that survive every engagement.

What we believe

Eavesdropping is a business risk, not a gadget problem. The question that matters is never "is there a device?" but "can the conversations that determine our valuation, our litigation position or our family's safety be overheard, and by whom?" We scope, execute and report accordingly. Clients receive risk findings and business decisions, not equipment read-outs.

Independence is a control. We sell no hardware, install no systems, and accept no commissions or referral fees. A provider who profits from selling you equipment has an incentive to find problems that equipment solves. Our only deliverables are assurance, evidence and advice, which is why our findings are trusted by boards, insurers and courts.

Discovery is the beginning, not the end. A discovered device raises immediate questions of attribution, exposure and response. Because Risk3 combines TSCM with investigations, digital forensics and eDiscovery capability, the same team that finds a compromise can determine what was taken, who benefited, and how to support legal action, without briefing a second firm into your most sensitive matter.

How we work

Every engagement begins with a confidential consultation, usually with a principal, director or counsel. We establish what information is at risk, where it is discussed, and who would benefit from collecting it. From that threat model we scope a proportionate engagement, a single pre-meeting inspection, a multi-site electronic privacy audit, or a standing regional programme.

Fieldwork is conducted by senior consultants using professional-grade detection equipment and a documented methodology, typically outside business hours and under cover arrangements where required. Engagements conclude with a written report drafted for decision-makers: findings, exposure assessment, and prioritised remediation, in language a board can act on and a court can rely on.

Where we operate

Risk3 is headquartered in Hong Kong and operates throughout Asia-Pacific: Singapore, Macau, Mainland China, Japan, South Korea, Thailand, Malaysia, Indonesia, the Philippines and Australia. Regional work is coordinated from Hong Kong to a single standard of methodology, confidentiality and reporting, whether the environment is a Central boardroom, a Tokyo deal room or a family compound in Jakarta.

What we will not do

A countermeasures practice should be judged by its refusals as much as its capabilities. Risk3 does not conduct surveillance of any kind, for anyone. We do not sell, install or take commission on equipment. We do not accept work requiring unlawful access to premises, devices or data in any jurisdiction. We do not act against existing clients, and we do not act for sanctioned parties. Enquiries that ask for any of these are declined, and the enquiry itself stays confidential.

The full statement of governance, vetting, insurance and conflict-check practice is on The Firm page, written so that a general counsel can verify it before the first call.