About
The practice.
Offsecure is a cybersecurity practice. The work spans technical testing, adversary simulation, consulting, and managed detection and response. Clients use it to put their risk in order, and to spend their attention on the business.
The practice is built for a regulatory landscape that keeps moving. The job is to show where the risk actually sits, so the organization can deal with that and return to the work it exists to do.
Who we are
Consultants work across regions. The engagement is still specific. The person on it learns the organization in front of them, and the recommendation is written for that organization.
The work is both offensive and defensive. Red teaming, threat intelligence, and managed security are parts of one practice, not three unrelated catalogs.
What the consultants hold
Qualifications are held across the practice. An engagement draws on the ones the work needs.
CREST, OSCP, CISSP, GXPN, OSWE, and CTRL.
How the work is conducted
Integrity
Honest assessments. The recommendation is independent of the answer a client might prefer to hear, and confidentiality holds for the whole engagement.
Excellence
The team keeps current with the techniques and the standards the work depends on. The method is refined when the threat moves.
The client
The requirement is taken from the organization itself. The support stays with that requirement, including the threat factors that are particular to it.
Frequently asked questions
What types of vulnerabilities do you test for in application security testing?
SQL injection, cross-site scripting, insecure direct object references, security misconfigurations, and the others that apply to the type of application under test.
How is purple teaming different from a red team or a blue team engagement?
Purple teaming is a collaborative test of detection and response. Each action is passed on a channel agreed in scoping, and the defenders return what they saw. It is not a red team run without the defenders, and it is not a defensive review on its own.
What frameworks do you follow for threat intelligence?
TIBER, Threat Intelligence-Based Ethical Red-teaming, and CBEST. The intelligence phase is kept separate from the red team phase, which is what those frameworks require.
How does the phishing service differ from an automated one?
The campaigns are handcrafted, including the technique. That is a closer simulation than a plug-and-play campaign.
What cloud environments do you test?
AWS, Azure, and Google Cloud, including hybrid and multi-cloud estates.
What is a virtual CISO, and what does the organization get from one?
A virtual CISO is a security lead engaged part time, providing the guidance of a chief information security officer without a full-time hire. The work is strategy, risk, and compliance. The engagement is the Virtual CISO service.
How often should testing be done?
After a significant change, an update, or an incident, and at least once a year for application and network testing. Phishing exercises at least annually, so recognition does not fade.
Do you help with remediation after the test?
Yes. The report includes the recommendation, and support continues while the fixes are made.