Dracosec Research Limited Logo
Home
News
Events
Services
About Us
SA Portal
Contact
Home / About Us
Our Story

About DracoSec

We are a team of dedicated cybersecurity professionals committed to protecting organizations from emerging threats through expert security assessment services.

Our Story

Founded in 2024, DracoSec began with a simple mission: to make the digital world safer for businesses and organizations of all sizes. What started as a small team of passionate security researchers has grown into a globally recognized cybersecurity firm with a reputation for excellence.

Our founder, a well known cybersecurity professional in cybersecurity industry, recognized a critical gap in the market – organizations needed more than just automated security tools; they needed expert guidance from professionals who understood both the technical and business aspects of cybersecurity.

Today, we serve clients across multiple industries and continents, providing comprehensive security assessment services that help organizations identify vulnerabilities, strengthen their security posture, and protect their valuable digital assets from emerging threats.

Meet Our Core Team

Elite offensive-security practitioners holding some of the industry’s most demanding certifications, with a proven record of protecting organisations across finance, government and critical industries.

Chris Chan

Chris Chan

Founder & CEO Β· Chief Penetration Tester

Founder & CEO of DracoSec and its Chief Penetration Tester, Chris Chan is one of Hong Kong’s most decorated offensive security practitioners. He leads red teams that think and act like real attackers, evaluating enterprise security products and advising banks, government bodies, multinational groups, schools and NGOs on exactly where they are exposed and how to close the gap.

Having taught himself the craft, Chris grew into an industry authority who has responsibly disclosed vulnerabilities to global technology leaders including ASUS, Yahoo, eBay and Apple, and has presented research credited with CVE identifiers on stage at HITCON and the Information Security Summit. He holds the complete OffSec certification suite, including OSEE, one of the hardest credentials in the field, which he was among the first in Hong Kong to earn and which remains held by only a handful of local experts, and he is an Authorized OffSec Instructor.

His years in senior roles at UDomain, ASTRI and Potai Bullion give him a rare read on how attackers think and where organisations truly break. Every finding he delivers is backed by proof and a practical fix his clients’ developers can act on immediately, because the systems he tests protect their most valuable data.

Specialties

Exploit Development Β· Vulnerability Research Β· Security Assessments

Professional Affiliations
BSidesHK Founder OffSec HK Ambassador
Primary Certifications
Authorized OffSec Instructor (PEN-100 & PEN-200) CISSP OSCE OSCEΒ³ OSEP OSWE OSED OSEE OSMR OSCP OSWP

Krecendo Hui

Cyber Security Manager & Senior Penetration Tester

Over five years across penetration testing, red team operations and cloud security. His security programmes kept Hong Kong NGOs incident-free for years despite advanced persistent threats, backed by a First Class Honours BSc in Cybersecurity.

Specialties

Red Team Operations Β· Cloud Security Β· Vulnerability Assessment

Professional Affiliations
BSidesHK Secretary & Organizer OffSec HK Ambassador
Primary Certifications
OSEP OSCP CRTP ACP-Sec

William Lam

Senior Penetration Tester

Specialises in web and API security and penetration testing, with successful engagements across the finance, property and government sectors. His development experience means findings come with root-cause analysis and practical, developer-ready fixes, not just surface-level patches.

Specialties

Web & API Security Β· Penetration Testing Β· Secure Development

Primary Certifications
OSWE OSCP CRTP CEH

Our Mission, Vision & Values

The principles that guide our work and define our approach to cybersecurity.

Our Mission

To protect organizations from cyber threats by providing expert security assessment services that identify vulnerabilities, strengthen security postures, and safeguard valuable digital assets.

Our Vision

To be the most trusted cybersecurity partner for organizations worldwide, setting the standard for excellence in security assessment services and contributing to a safer digital ecosystem for all.

Excellence

We are committed to delivering the highest quality security assessment services, continuously improving our methodologies, and staying at the forefront of cybersecurity research.

Integrity

We conduct our business with the highest ethical standards, maintaining confidentiality, honesty, and transparency in all our client engagements and professional relationships.

Innovation

We embrace creativity and forward-thinking approaches to cybersecurity, developing new methodologies and tools to address emerging threats and evolving security challenges.

Our Journey

Key milestones in our company's history and growth.

06/2024

Company Founded

DracoSec was established by a team of cybersecurity experts with a mission to provide expert security assessment services.

09/2024

First Major Client

Secured our first enterprise client, one of the virtual bank, marking a significant milestone in our company's growth.

01/2025

International Client

International game console company engaged us, expanding our services to International client.

03/2025

Financial Institution Client

We have a major Financial Institution Client request for a continuous security assessment

04/2025

Operational Technology Client

Transportation Client engaged us to provide their new Operational Technology Security Assessment

05/2025

Research Division Established

Launched our dedicated research division focused on identifying emerging threats and developing innovative security assessment tools.

Why Choose DracoSec

What sets us apart from other cybersecurity firms.

10+
Years of CyberSecurity Experience
10+
Accepted Common Vulnerabilities and Exposures (CVE)
1000+
Security Assessments Experience
98%
Client Retention Rate

Expert Team

Our team consists of highly skilled cybersecurity professionals with diverse backgrounds in offensive security, defensive security, compliance, and risk management. Many of our consultants hold advanced certifications including OSCP, OSCE, CISSP, and more.

We invest heavily in continuous education and training to ensure our team stays at the forefront of cybersecurity knowledge and techniques.

Comprehensive Approach

We don't just identify vulnerabilities; we provide a holistic view of your security posture with actionable recommendations tailored to your specific business needs and risk tolerance.

Our assessments combine automated tools with manual testing and expert analysis to ensure thorough coverage and minimize false positives.

Industry Experience

With over a decade of experience serving clients across various industries, we understand the unique security challenges and regulatory requirements faced by different sectors.

Our specialized teams have deep expertise in financial services, transportation, technology, retail, government, and manufacturing sectors.

Client-Centric Focus

We prioritize building long-term relationships with our clients, taking the time to understand their business objectives, security goals, and risk tolerance.

Our high client retention rate is a testament to our commitment to delivering exceptional service and value with every engagement.

Our Certifications

Industry recognitions that validate our expertise and commitment to excellence.

CISSP (Certified Information Systems Security Professional)
OSCE (Offensive Security Certified Expert)
OSCEΒ³ (OffSec Certified Expert 3)
OSEP (OffSec Experienced Penetration Tester)
OSWE (OffSec Web Expert)
OSED (OffSec Exploit Developer)
OSEE (OffSec Exploitation Expert)
OSMR (OffSec macOS Researcher)
OSCP (OffSec Certified Professional)
OSWP (OffSec Wireless Professional)
CBSP (Certified Blockchain Security Professional)
CRTP (Altered Security Certified Red Team Professional)
ACP - Cloud Security (Alibaba Cloud Certified Professional - Cloud Security)
AWS Certified Security - Specialty
CEH (Certified Ethical Hacker)
eJPT (INE Security’s Junior Penetration Tester)
CRT (CREST Registered Penetration Tester)

Why Certifications Matter

Security certifications validate the technical skills and knowledge of our team members. They ensure that our security testers:

Possess practical, hands-on skills required for effective security testing

Stay current with the latest attack techniques and security methodologies

Understand both offensive and defensive security principles

Can identify and exploit vulnerabilities that automated tools might miss

Follow industry best practices and ethical guidelines

When you work with DracoSec, you're working with professionals who have proven their expertise through rigorous certification processes and real-world experience.

150+
Satisfied Clients
10
Industries Served

Industries We Served Most

We work with organizations of all sizes across various industries to enhance their security posture.

Financial Services

Protecting financial institutions from cyber threats and ensuring compliance with industry regulations.

Transportation

Securing transportation systems while ensuring regulatory compliances and operational continuity.

Technology

Helping tech companies secure their products, services, and infrastructure against evolving threats.

Retail

Protecting e-commerce platforms, point-of-sale systems, and customer data from breaches and fraud.

Government

Securing critical government infrastructure and sensitive data against sophisticated cyber threats.

Manufacturing

Protecting industrial control systems, operational technology, and intellectual property.

Industry Case Studies

Explore how we've helped organizations across various industries strengthen their security posture and protect their valuable assets.

Financial Services Security
Financial Services

Securing a Global Banking Infrastructure

We helped a leading financial institution identify and remediate critical vulnerabilities in their core banking systems.

15+
Critical Vulnerabilities Fixed
60%
Risk Reduction
OT Security
Transportation

Protecting Automobile Safety

Our comprehensive security assessment helped a Transportation company client to protect their automobiles with OT security.

2
Critical Vulnerabilities Fixed
80%
Risk Reduction
Tech Startup Security
Technology

Securing a Cloud-Native SaaS Platform

How our cloud security assessment helped a fast-growing SaaS company secure their AWS infrastructure and DevOps pipeline.

45%
Security Improvement
10
AWS Services Secured

Industry Success Stories

Learn how our security services have made a real difference across various industries.

From Vulnerable to Secure: A Retail Transformation

A major retail company approached us after experiencing a data breach. Our team conducted a comprehensive security assessment, identifying numerous vulnerabilities in their point-of-sale systems and e-commerce platform.

Working closely with their IT team, we implemented a robust security program that included:

  • Regular vulnerability scanning and penetration testing
  • Security awareness training for all employees
  • Implementation of a secure development lifecycle
  • Deployment of advanced threat detection solutions
Result: No security incidents in the 12 months following our engagement.

Securing Critical Infrastructure for Transportation Provider

An Transportation provider responsible for delivering package to millions of customers needed to secure their operational technology (OT) against emerging cyber threats.

Our specialized OT & ICS security team:

  • Conducted a comprehensive assessment of their industrial control systems
  • Identified segmentation issues between IT and OT networks
  • Developed a custom security framework aligned with IEC 62443 standards
  • Conduct site visit to check physical security.
Result: Enhanced security posture for critical infrastructure, with clear separation between IT and OT networks and improved threat detection capabilities.

Our Partners

Strategic alliances that reinforce our excellence and broaden our impact.

BSides Hong Kong
OffSec Hong Kong Chapter
eWalker Consulting (HK) Limited
Wizlynx Group
CloudMile Inc.
Reach Technology Solutions Limited
Advanced Security Technology and Research Laboratory Company Limited
Nova Security New Zealand
SYON Security Limited
Blackpanda Group

Ready to Work with Us?

Contact our team today to discuss how we can help strengthen your organization's security posture and protect your valuable digital assets from emerging threats.

Contact Us Explore Our Services