Penetration testing and security consultancy for teams that need a straight answer, not a scanner report.
DDSec is a Sydney-based security consultancy delivering manual-first penetration testing, IT security consultancy, and secure application development. Independent, hands-on, and run by a practising security researcher.
Services
Engagements are scoped around your actual risk, not a fixed checklist.
Penetration Testing
Web application, API, and network/infrastructure assessments. Authenticated and unauthenticated testing, business-logic and authorisation-boundary focus alongside standard technical classes, with reproducible proof-of-concept evidence for every finding.
IT & Security Consultancy
Security architecture review, cloud configuration review, infrastructure hardening, and practical risk prioritisation for teams without an in-house security function.
Application Development
Custom web and mobile application development built with a secure-by-design process — threat modelling, secure coding practices, and review baked in rather than bolted on afterward.
Approach
Testing is methodology-driven and reported in plain language, mapped to recognised industry standards.
- Standards-aligned methodology — testing informed by the OWASP Testing Guide, PTES (Penetration Testing Execution Standard), and NIST SP 800-115.
- Manual-first testing — automated tooling supports the work; it does not replace it. Findings are hand-verified before they are reported.
- Evidence over assertion — every reported issue includes a reproducible proof-of-concept and a concrete impact statement, not a severity score alone.
- Clear, actionable reporting — findings are written for both an engineering team to fix and a non-technical stakeholder to understand.
About
DDSec is an Australian security practice, currently operating as a sole trader while a dedicated application is in development. Independent vulnerability research — including active work across leading bug bounty platforms — directly informs how engagements are scoped and tested; attacker-side experience is applied back into defensive and consultancy work.
- Entity
- David Duong — Individual / Sole Trader
- ABN
- 56 239 087 517
- Location
- Sydney, NSW, Australia
Contact
Get in touch to discuss scope, timelines, or a vendor/partner security review.
[email protected]