01Service line
Cybersecurity services: advisory, testing, engineering, detection and response
Onion Infosec assesses risk, tests systems the way an attacker would, engineers controls across identity, cloud, data and applications, and runs detection and response 24×7. Each engagement ends with evidence, a prioritized fix list and, where you want it, the engineers to carry out the fixes.
- Line
- 01 of 07 · Cybersecurity
- Shape
- Assess → Protect → Detect → Respond
- Delivery
- Project, retainer or managed service
01Context
What the cybersecurity line covers
The cybersecurity line has seven capability groups. They are advisory and GRC, offensive security, application security, protection of identity, cloud and data, detection and response, threat intelligence, and incident response and forensics. Each group can be engaged on its own. Together they cover the full cycle: assess risk, test controls, build protection, monitor, and respond when something goes wrong.
Work is delivered remotely and on site, as fixed-scope projects, retainers or managed services. Security monitoring and incident response readiness are available 24×7. What the practice learns feeds Security Labs research and the security products Onion is developing.
- Controls need independent testing
- A control that has never been tested is an assumption. Manual testing and adversary simulation show which weaknesses can be reached and chained, so remediation effort goes to the paths that lead to sensitive data and critical systems.
- Customers and regulators ask for evidence
- Procurement teams, auditors and regulators expect a documented risk assessment, tested controls and a working incident process. A program built on controls that operate produces that evidence as a by-product of normal work.
- Detection and response take practice
- Monitoring works when telemetry is complete, detections reflect real attacker behavior and the response path has been rehearsed. Staffing that around the clock is difficult for most internal teams.
Architecture
How detection and response fit together.
Assessment and protection work reduce what can go wrong. This is the part that runs every day: what is collected, where it is correlated, who investigates, and how each incident makes the next detection better.
Six telemetry sources (identity, endpoint, network, cloud, email, and SaaS and applications) feed one pipeline. Stage one collects telemetry. Stage two correlates it in a SIEM or XDR platform such as Microsoft Sentinel, Splunk or Elastic. Stage three is detection engineering mapped to MITRE ATT&CK. Stage four is investigation by analysts and threat hunting. Stage five is incident response and digital forensics. Stage six, tuning and threat intelligence, returns to detection. Red teaming and adversary simulation test the detections.
Sources
- IdentityEntra ID · Active Directory
- EndpointEDR
- NetworkPerimeter · internal
- CloudAWS · Azure · Google Cloud
- EmailMicrosoft 365
- SaaS and applicationsAudit logs
Pipeline
- TelemetryLog onboarding, parsing and health checks.
- SIEM and XDRMicrosoft Sentinel, Splunk or Elastic. Related signals become one incident.
- Detection engineeringDetections written and tested as code, mapped to MITRE ATT&CK.
- Analysts and threat hunting24×7 triage, investigation and hypothesis-led hunts.
- Incident response and DFIRContainment, evidence-sound forensics and recovery.
- Tuning and intelligenceThreat intelligence and incident findings become new detections.
Findings, tuning and intelligence return to detection
- Telemetry and incident flow
- Feedback into detection
02Approach
How we work
Every engagement starts from your threat model and business context: what you run, what matters most and who is likely to target it. Scope, rules of engagement and deliverables are agreed in writing before work begins.
Testing is manual and findings are validated before they are reported. Advisory work ends in controls that operate. Managed services run to documented runbooks with agreed escalation paths.
01
Validated findings
Every reported vulnerability is confirmed by hand, with evidence and reproduction steps. Unexploitable scanner output is left out.
02
Attack paths over finding counts
Individual issues matter less than the routes they create. Reports show how weaknesses chain together, from an exposed endpoint to privileged access.
03
Controls that operate
Compliance work is anchored to risk assessment. Policies are short, specific and mapped to how teams work, so evidence comes from normal operations.
04
Fix what we find
Remediation guidance is written for engineers. Where you want hands-on help, Onion cloud, development and IT teams can carry out the fixes.
03Capabilities
How cybersecurity work is organized.
Assess
Understand risk, obligations and what an attacker can reach.
Protect
Engineer controls into applications, identity, cloud and data.
Detect
Watch for adversary behavior, informed by intelligence.
Respond
Contain, investigate and recover when it counts.
Advisory & GRC
Governance, risk and compliance advisory anchored to real risk, from gap assessment to audit support. Onion is not a certification body. External audits are performed by independent accredited firms.
- Cyber risk assessmentStructured assessment of threats, assets and existing controls against business impact. Output is a risk register with treatment plans that leadership can act on.
- Security assessments and auditsControl assessments, configuration reviews and internal audits against a chosen baseline. Each finding is evidenced, rated and paired with a remediation step.
- Security architectureReview and redesign of identity, network, cloud, data and operations as one architecture. You receive a documented current state, a target design and a sequenced roadmap with owners.
- ISO 27001 and SOC 2 readinessGap analysis, ISMS design, control implementation support, internal audit and evidence programs for ISO/IEC 27001:2022 and the SOC 2 Trust Services Criteria. Audit support continues until the external auditor has finished.
- PCI DSS, NIST CSF and CIS ControlsReadiness assessment for PCI DSS, program structuring against NIST CSF and prioritized hardening to the CIS Controls. One control set is mapped across frameworks so that work is done once.
- Regulatory readinessReadiness and advisory for regulations such as GDPR, HIPAA, NIS2 and DORA, and for regional requirements such as the DPDP Act, SEBI CSCRF and CERT-In directions. Scope is set against the obligations that apply to you.
- Third-party risk managementVendor inventory, tiering by data access and operational dependence, proportionate assessment and contract security requirements. Critical vendors receive technical validation and ongoing monitoring.
Offensive Security
Manual penetration testing and adversary simulation across applications, infrastructure, cloud and wireless. Findings are validated, evidenced and rated by exploitability and business impact.
- Web application penetration testingManual testing to OWASP standards covering authentication, authorization, session management, injection, SSRF, business logic and the client side. The report gives evidence and reproduction steps for every finding.
- Mobile application penetration testingiOS and Android testing for insecure storage, API abuse, reverse engineering exposure, runtime manipulation and platform misconfiguration.
- API penetration testingREST and GraphQL testing for broken object-level authorization, mass assignment, rate-limit gaps and injection, run against documented and undocumented endpoints.
- Network and wireless penetration testingExternal and internal infrastructure testing of exposed services, segmentation, privilege escalation and lateral movement, including Active Directory. Wireless testing covers rogue access points, weak authentication and guest separation.
- Cloud penetration testingTesting of AWS, Azure and Google Cloud environments for IAM privilege escalation, misconfigured storage, serverless weaknesses and metadata-service abuse.
- Red team and purple team exercisesObjective-based campaigns mapped to MITRE ATT&CK that test detection and response as well as prevention. Purple team sessions replay techniques with your defenders and record which detections fired.
- Attack surface assessmentDiscovery of internet-facing assets, services and management planes, including those missing from the inventory. Results feed a vulnerability management program with exploitability-based priorities.
Application Security
Security placed in design reviews, pull requests and pipelines, where issues are cheapest to fix. The work is done with your engineering teams, and controls are delivered as code they own.
- Secure SDLCA security development lifecycle mapped to how your teams work, from requirements and design to build and release. Output is a set of standards, checkpoints and owners.
- Threat modelingStructured analysis of new features and architectures to find design-level flaws before code is written. Each session produces a threat model and a list of design changes.
- DevSecOps and pipeline securityHardening of CI/CD itself: secrets management, runner isolation, branch protection, artifact signing and policy as code. Security checks run in pull requests and are tuned for signal.
- Source code reviewManual and tool-assisted review of security-critical code paths such as authentication, cryptography and payment flows, which dynamic testing cannot reach.
- SAST, DAST and SCASelection, integration and tuning of static, dynamic and composition analysis in your pipelines. Rulesets are tuned to your stack and false-positive baselines are documented.
- Software supply chain securitySBOM generation, dependency governance, artifact signing and build provenance aligned to SLSA principles.
Identity, Cloud & Data Protection
Engineering of the controls that decide whether a stolen credential or a misconfiguration turns into an incident. We design, implement and tune these controls on the platforms you already run.
- Identity securityHardening of Entra ID and Active Directory, privileged access management, phishing-resistant MFA, conditional access and access governance. Work starts from a map of effective privilege across directories and cloud IAM.
- Zero trustA sequenced program that starts with identity, adds device posture to access decisions and segments networks and workloads in phases. Each phase has a defined scope and owner.
- Email securityConfiguration of SPF, DKIM and DMARC, anti-phishing and attachment policies, and mailbox audit settings. Logging is set up so that a business email compromise can be investigated.
- Cloud securityAssessment, architecture and hardening of AWS, Azure and Google Cloud: IAM entitlements, posture management, workload protection, and control-plane logging and detection.
- Data securityData discovery and classification, DLP policy design and tuning, encryption and key management, database security and backup protection.
- Microsoft security stackDesign and operation of Microsoft Defender, Sentinel, Entra ID and Intune. The first step is an audit of what is licensed against what is enabled, enforced and monitored.
Detection & Response
Security operations run as an engineering discipline: measured telemetry, detections mapped to MITRE ATT&CK, documented triage and rehearsed response. Monitoring is available 24×7, fully managed or co-managed with your team.
- Managed SOC and 24×7 security monitoringRound-the-clock monitoring, triage and escalation by tiered analysts working to documented runbooks. Escalations arrive with evidence and a recommended action.
- Managed detection and response (MDR)Detection, investigation and containment across endpoint, identity and cloud telemetry, with response actions agreed in advance.
- SIEM engineering and managementDeployment, log-source onboarding, tuning and content management on platforms such as Microsoft Sentinel, Splunk, QRadar, Elastic and Wazuh. Ingestion is reviewed against the detections that use it.
- EDR and XDR operationsDeployment, policy hardening, alert handling and host isolation on the endpoint and extended detection platforms you own.
- Detection engineeringCustom detection content built from adversary techniques, tested against simulated attacks and versioned like code. Coverage is reported against ATT&CK, gaps included.
- Threat huntingHypothesis-driven hunts across endpoint, identity and cloud telemetry for behavior that existing rules do not catch. Each hunt ends in a report and, where useful, new detections.
- SOC modernizationTelemetry audit, ATT&CK coverage assessment, detection re-engineering and triage automation for an existing SOC. Output is a measured baseline and an uplift roadmap.
Threat Intelligence
Intelligence scoped to your sector, technology and exposure, delivered in a form that detection, response and risk teams can use.
- Threat intelligence reportingIntelligence requirements are set with your security and risk leads. Regular reports then cover the actors, techniques and vulnerabilities relevant to your sector and technology stack.
- Dark web monitoringMonitoring of criminal forums, marketplaces and leak sites for your credentials, data and domains. Confirmed exposures are reported with source context and recommended actions such as credential resets.
- Indicator enrichmentIndicators are enriched with actor, campaign and confidence data and delivered into your SIEM or SOAR, so that alerts reach analysts with context attached.
- Intelligence-led detectionReported techniques are translated into hunt hypotheses and detection content, prioritized by relevance to your environment.
Incident Response & Forensics
Response and investigation for active or suspected intrusions, plus the preparation that shortens them. Evidence handling follows forensic practice so that findings hold up under regulatory, insurance and legal review.
- Incident responseScoping, containment and eradication of active intrusions such as ransomware, business email compromise and insider events. Response readiness is available 24×7.
- Digital forensics (DFIR)Forensically sound acquisition and analysis of disks, memory, logs and cloud audit trails, with chain of custody maintained. Output is an intrusion timeline with evidence references.
- Malware analysisStatic and dynamic analysis to establish what a sample can do, how it communicates and what it touched. Indicators and detection logic are handed to the monitoring team.
- Compromise assessmentAn evidence-based review of endpoints, identity and logs that answers whether an attacker is present now or has been recently.
- Incident response readinessIR plans, scenario playbooks and tabletop exercises for leadership and technical teams, including a map of regulatory notification timelines.
- Incident response retainerEngagement terms, environment onboarding and communication channels are set up before an incident, so that response can start without contract work.
04Process
How a cybersecurity engagement runs.
Scope
We map the environment and agree objectives, rules of engagement, test windows and emergency contacts. The statement of work names the deliverables.
Assess or onboard
Projects begin with reconnaissance, document review or a gap assessment. Managed services begin with log-source onboarding, runbooks and escalation paths.
Execute
Testing, implementation or monitoring runs within the agreed boundaries. Critical findings are reported as soon as they are confirmed.
Report
Leadership receives a summary of risk in business terms. Engineers receive technical findings with evidence, reproduction steps and prioritized remediation guidance.
Remediate and verify
We stay available during the fix cycle and retest remediated findings where retesting is in scope. Onion engineers can carry out the fixes if you want them to.
Review
Managed services and retainers have regular service reviews. Incidents, false positives and test results feed back into detection content and the roadmap.
What you receive
- Executive summary with risk described in business terms
- Technical findings with evidence, reproduction steps and CVSS scoring adjusted for context
- Attack-path analysis showing how findings chain together
- Prioritized remediation roadmap with owners
- Gap assessment, risk register and treatment plans for advisory work
- Detection use cases mapped to MITRE ATT&CK, with runbooks and an escalation matrix
- Regular service reports on coverage, incidents and tuning actions for managed services
- Incident reports with timeline, scope of compromise and root cause
05Technical depth
Typical cybersecurity engagements, technology and methods.
Penetration test
Fixed-scope project against one or more applications, networks or cloud environments, usually measured in weeks. A retest of remediated findings can be included in scope.
Gap assessment and readiness program
A short assessment against the target framework, followed by a multi-month implementation program that ends with an internal audit and support during the external audit.
Red team exercise
Objective-based campaign over an extended window, known only to a small group on your side. It closes with a joint debrief between testers and defenders.
Managed detection and response
Ongoing managed service. An onboarding phase covers log sources, runbooks and escalation paths, then 24×7 operation begins with regular reporting and service reviews.
Incident response retainer
Annual retainer with environment onboarding, a readiness review and pre-agreed engagement terms.
Security architecture review
Time-boxed advisory engagement that documents the current state, defines a target architecture and delivers a sequenced roadmap.
Technology areas
SIEM and analytics
Endpoint and XDR
Identity
Cloud platforms
Application security tooling
Testing and forensics
Technologies are named to describe the work. Naming a product does not indicate a commercial partnership.
Frameworks and methods
MITRE ATT&CK
Maps detection coverage, plans red team and purple team exercises, and structures threat hunts.
OWASP ASVS, Top 10 and testing guides
Define test coverage for web, mobile and API assessments.
PTES
Structures penetration test phases from scoping to reporting.
CVSS
Scores findings, with severity adjusted for business context.
NIST CSF
Structures security programs and maturity assessments.
ISO/IEC 27001
Baseline for ISMS design, gap assessment and internal audit.
CIS Controls and Benchmarks
Prioritized hardening baselines for configuration reviews.
NIST SP 800-61
Reference for incident handling phases in IR plans and playbooks.
06Across lines
Engineering to fix what we find.
Onion also builds and runs technology, so the organization that reports a weakness can fix it. Cloud engineers rebuild landing zones and IAM as code, and development teams correct application flaws and harden pipelines. IT operations closes patching, hardening and backup gaps. Remediation is scoped separately from testing, and a retest confirms closure.
07Questions
Cybersecurity: questions we are asked
A scan lists known vulnerabilities automatically. A penetration test is manual: testers examine logic, chain findings into attack paths and confirm every result. The report contains fewer findings, and each one is real.
Rules of engagement are agreed up front, including test windows, excluded systems and emergency contacts. Destructive techniques are never used without explicit written authorization.
No. Certification and attestation audits must be independent, and they are performed by accredited certification bodies or licensed audit firms. We prepare you, support control implementation and assist during that audit.
No. We operate the platforms you own, such as Microsoft Sentinel, Splunk, QRadar, Elastic, CrowdStrike and Microsoft Defender. A change is recommended only when the current tooling cannot meet the requirement. Runbooks and detection content built for you remain yours.
Members of our team hold OSCP, CISSP, CISM, CEH, CHFI and more. These are individual certifications, not company accreditations.