We find the threats before
they find your business.
Onidef is an independent offensive-security firm. We perform adversarial testing, deliver audit-grade compliance, and run a 24/7 response capability — for the teams that cannot afford to learn they were breached on the news.
A complete defensive perimeter — built by people who attack for a living.
Most consultancies sell either offense or paperwork. We deliver both, then close the loop with the engineering and monitoring required to keep the result intact. Every engagement is led by a senior practitioner — never a project manager.
Penetration
Testing
Black-box, grey-box and assumed-breach testing across web, mobile, API, cloud and corporate networks. Findings are weaponized for proof — and triaged for impact.
- Web & API
- Mobile (iOS / Android)
- Internal / AD
- Cloud (AWS · GCP · Azure)
- Red Team
Certifications
& Audits
End-to-end programs for ISO 27001, SOC 2 Type II, PCI DSS v4.0, GDPR and NIS2 — from gap assessment to evidence collection, internal audit and certifying-body liaison.
- ISO 27001 / 27017 / 27018
- SOC 2
- PCI DSS
- GDPR · NIS2
- HIPAA
Vulnerability
Assessment
Continuous attack-surface management and threat modeling. We map your real perimeter, score what matters, and tell engineers which fix returns the most risk reduction per hour.
- ASM
- Threat Modeling
- SBOM & Supply Chain
- Cloud Posture
- Code Review
Incident Response
& SOC
A retained team on standby. Detection engineering, 24/7 monitoring, containment, forensic investigation and post-incident hardening — all with a contractual response SLA.
- 24/7 SOC
- DFIR
- Threat Hunting
- Ransomware
- Tabletop Exercises
They acted like part of our engineering team — not like a vendor checking boxes. We shipped SOC 2 in fourteen weeks.
Four principles we will not negotiate on.
Our offer is narrow on purpose. We turn down work that does not fit because the alternative — generic, undifferentiated security consulting — has been failing organizations for two decades.
-
P / 01Senior-only engagement teamsEvery test, every audit, every incident is led by a practitioner with at least ten years of operator experience. We do not staff with juniors and bill seniors. If you meet our lead on the kickoff, you keep them through delivery.
-
P / 02Findings that survive scrutinyEach vulnerability is reproduced with documented evidence — and a working remediation path written by someone who could have shipped the fix themselves. No theoretical risk dressed up as critical.
-
P / 03Compliance as engineering, not theatreWe build control frameworks that pass external audits and continue to hold when nobody is looking. Evidence is produced once and reused across ISO, SOC 2, PCI and GDPR — not re-collected every quarter.
-
P / 04A standing relationship, on retainerThe work is rarely done. Threat models change, codebases mutate, regulators issue new guidance. Our retainer keeps a named team available for the question you have at 17:00 on a Friday.
A small firm with an unreasonable record.
Selected metrics across active and concluded engagements as of Q2 2026. Detailed case studies available under NDA.
Six stages, repeated until the report would survive a deposition.
Each engagement is structured around the same backbone. Specific tactics, techniques and procedures vary; the discipline does not.
-
01 · SCOPEScoping & rules of engagementWe define crown-jewel assets, attack windows, escalation channels and legal authorisation in writing — before a single packet leaves our lab.
-
02 · RECONReconnaissance & intelligencePassive and active mapping of the real attack surface, including third-party dependencies, exposed credentials and infrastructure drift.
-
03 · ATTACKExploitation & lateral movementManual exploitation of identified weaknesses, chained where credible. We pursue impact — not vulnerability counts.
-
04 · REPORTReporting & reproducibilityTwo reports: an executive narrative for the board, and a technical dossier in which every finding is reproducible by your engineers.
-
05 · REMEDIATERemediation supportWe pair with your engineers through the fix. Where helpful, we write the patch ourselves and submit a pull request.
-
06 · RETESTRetest & attestationClosed findings are independently retested. A signed attestation letter is delivered for use with customers, partners and regulators.
Recent writing from the practice.
Sanitised dispatches from active work — disclosures, lessons learned and opinions held loosely. Read all insights →
From an unpatched VPN appliance to domain admin in eleven minutes.
A walk-through of a recent assumed-breach engagement against a 4,000-seat European insurer — and what could have stopped us at four different chokepoints.
Why most SOC 2 Type II audits fail on their first attempt.
The eight control families where remediation work tends to compound — and a sample evidence schedule that survives a real auditor without rework.
CVE-2026-21118 · Privilege escalation in a popular Node.js framework.
Coordinated disclosure timeline, proof-of-concept and mitigation guidance for a vulnerability we found in a widely-used middleware library.