The human firewall is not a firewall
Phishing and fiction: The human is not the control Introduction At a recent on-line presentation, we introduced the audience to a new
Trusted for over 25 years
dotSec is an established Australian cyber security company, with more than 25 years’ experience delivering testing and assessment, managed security services (including SOC/SIEM/MDR, and incident response), and governance, risk and compliance services for organisations across Australia.
Our team combines senior engineering expertise with certified assessors, threat analysts and compliance specialists to help you reduce risk, strengthen control effectiveness and meet your regulatory and customer obligations.
dotSec provides cyber security services in three main areas: GRC, testing and assessment, and managed security services.
We help Australian organisations identify and prioritise risk, apply the right controls and verify they work, and meet the standards customers and regulators expect: ISO 27001, PCI DSS and practical maturity improvement.
Our managed services keep your controls working day to day: 24/7 monitoring and response, secure configuration, web application protection and identity security, run by the same senior team that tests and advises.
Independent security testing confirms whether your controls work as intended, and helps you prioritise remediation if they do not. Our testing and assessment services help boards, executives and technical teams make informed, risk-based decisions.
dotSec is a PCI QSA Company, a PCI DSS-compliant service provider and ISO 27001 certified. Each of the following can be checked on a public register or document:
Great outcomes are achieved when smart people collaborate in a good environment, and when the customer’s expectations are met or exceeded in every engagement, project or task.
dotSec can only rely on our customer’s feedback to know, for certain, that great outcomes have been achieved, and the testimonials (included below) that have been provided indicate that is the case.
Phishing and fiction: The human is not the control Introduction At a recent on-line presentation, we introduced the audience to a new
Hugging Face: Over the router, through the firewall, off to Grandma’s house we go* Introduction An AI was set an exam but
Five multi-billion-dollar companies in two months… the past and the future Your Content Security Policy is strict. Your HTTP monitoring is solid.
Managed SIEM services case study: tailored Splunk Enterprise Security for an Australian financial services platform A large Australian consumer-facing financial services business
dotSec works with organisations to identify and prioritise risks based on operational realities, compliance requirements, and business goals, allowing you to understand where to focus your time and money.
Understanding risk is only valuable if you act on it. The next step is to implement practical, risk-based controls. Let us work with you and you’ll have working defences, aligned with your business risk profile.
Controls only reduce risk if they work. We test them the way an attacker would, through penetration testing, phishing simulations and tabletop exercises, and our managed SOC watches for anything that gets past them. You get evidence that your defences hold up, not just an assumption.
Australian organisations across legal, finance, technology, utilities, education and professional services, from mid-sized firms through to large enterprises and government.
Yes. We provide consulting and managed security services to organisations across Australia, in cities and regional areas, and to clients in New Zealand and Asia on specialist projects.
Yes. We work across technical security and governance, risk and compliance. We are ISO 27001 certified and a PCI DSS-compliant service provider, and our team includes PCI QSA, ISO 27001 assessor and implementer, and IRAP assessor certifications.
Yes, and we prefer that approach. Most clients engage us to complement in-house capability, provide independent review, or supply specialist skills such as penetration testing.
No. Our SIEM/SOC service is run by our own (Australian, on-shore) team, on Splunk Enterprise Security hosted in per-customer (not shared) tenancies in AWS, with SAIINT reviewing triage decisions.
dotSec is an Australian cyber security company that has provided expert cyber security services since 2000. We’ve worked with clients across most private sectors and all tiers of government. We’ve worked with our oldest client for over 20 years, and our average client-retention time is around 10 years.
We provide cyber security services from our Brisbane office to organisations across Australia: Testing and assessment, including penetration testing, maturity reviews and adversary emulation; managed security services, including managed SIEM/SOC and WAF; and governance, risk and compliance for IRAP, PCI DSS and ISO 27001.
We are CREST-accredited through CREST ANZ, a PCI QSA Company, a PCI DSS-compliant service provider and ISO 27001 certified. We also provide IRAP assessment services. Our advice comes from implementing and maintaining these standards ourselves, not just assessing others.
Our case studies include an IRAP readiness project in which we helped a national service provider to the Australian Government prioritise and manage risk: dotSec ran a gap analysis against the controls the department had specified, then managed an 18-month program that addressed the gaps on time and on budget. The government accepted the final IRAP assessment report (IRAP case study). We did similar work for our own business when we prepared for ISO/IEC 27001:2022 certification in 2024, which we describe in our ISO 27001 case study.
Incident detection, containment, response and recovery are central to how we apply controls. Our own team runs a managed SOC on Splunk Enterprise Security, located in Australia. We operate the service using only onshore Australian employees. We maintain data confidentiality, separation and sovereignty by hosting a separate, unshared AWS tenancy for each customer in the AWS Asia Pacific (Sydney) Region.
We’ve deployed SIEM/SOC services for a wide range of clients in the government, education, retail and legal sectors. In one example, we built the in-house SIEM infrastructure (based on Splunk Cloud and Splunk Enterprise Security) for an Australian financial services platform. The final implementation included 205 detections across 13 log sources, all mapped to MITRE ATT&CK, and we developed behavioural exfiltration detection within the original budget (managed SIEM case study). For a national law firm, our DEXRR detection layer analyses more than 1.7TB of logs a quarter and more than 240 million events a day (data exfiltration case study).
To verify effect, we test controls the way an attacker would. That means penetration testing, adversary emulation, assumed-breach testing, and content-filtering and EDR-bypass testing. We run all of these as collaborative exercises (penetration testing case study). In many cases, the same assessors run security-maturity assessments in alternating years, using the same frameworks (aligned with the CIS Critical Controls), so the client can accurately measure improvements over time. We avoid months-long red-teaming engagements. We prefer small, continuous and discrete assessment projects that provide value for money within a reasonable time frame and budget.
If your organisation needs reliable penetration testing, meaningful SIEM/MDR services or practical GRC support, dotSec delivers. Our team combines senior engineering capability with ISO 27001 consulting for implementation or assessment, IRAP assessor certification and readiness experience, and PCI DSS expertise to provide clear, actionable outcomes backed by more than 25 years of proven experience.
