The test was real
Attack simulation is meant to resemble an actual adversary, across people, process, and technology. A checklist with no adversary is a different job.
Practice 05
DONE provides corporate cybersecurity across offense, cloud and infrastructure, secure development, governance, and the people who have to notice an attack.
The work
The defensein the open
The work
Real-world attack simulations, comprehensive security assessments, and continuous strategic guidance. The seven lines are the published scope. This page does not add a client, a finding, or a certificate.
- 01
Red teaming and adversary simulation
Simulating real-world APT attacks to test defenses across people, process, and technology.
- 02
Security assessment and hardening
Full-stack assessments for web, network, cloud, and Active Directory, with a remediation roadmap in priority order.
- 03
Cloud and infrastructure security
Configuration reviews for AWS, Azure, and on-premise environments, including identity, storage, and network segmentation.
- 04
Secure development and code review
Flaws in code and architecture, including the OWASP Top 10 and static and dynamic testing, and help for developers to build the safer pattern in.
- 05
Governance, risk, and compliance
Advisory that aligns controls with the standards they name: NIST, ISO 27001, PCI-DSS, and the CIS Controls. Naming a standard is the scope of the advice. It is not a certificate.
- 06
Awareness and phishing simulation
Training built for the employees, and ethical phishing campaigns, to measure and improve how people hold up.
- 07
Managed offensive security advisor
The published role is a vCISO and a virtual red-team lead: ongoing guidance, continuous watch on the attack surface, and a quarterly review of the posture.
How it is judged
A security engagement is judged by whether the organization can act on it. DONE has not published a finding, a score, or a letter of attestation.
The roadmap is ordered
An assessment that does not say what to fix first is unfinished. They publish prioritized remediation as the output.
The builders were included
Code review is paired with help for the developers. The point is the next release, not only the report.
It continues
The advisor line is quarterly, not a single week. Guidance that stops at the PDF is not the published offer.
The record
DONE has published the practice in full. It has not published a client name, a vulnerability, or a certificate.
The scope is the record
When an engagement can be told in public, it belongs here with the finding the client has agreed to share.
Questions
Is this a scan, or an adversary?
Both exist in the scope, and they are not the same line. Assessment and hardening is the full-stack review. Red teaming is the simulated attack. One does not replace the other.
Do they certify the company?
They advise on alignment with NIST, ISO 27001, PCI-DSS, and the CIS Controls. This page does not say DONE is certified, and it does not say a client left certified.
Who is the work for after the test?
The people who run the defense, the developers who ship the next change, and the employees who have to notice a phishing mail. All three are in the published scope.
Describe the system
Write about the assessment, the cloud, or the team that has to hold the line. The note opens in your mail app.
info@doneofficial.com