Client Portal Platform
SA Portal is a unified client workspace for managing your DracoSec engagements. Track active assessments, monitor your external attack surface in real time, receive curated threat intelligence relevant to Hong Kong, and review every deliverable β all in one place.
Replace email threads, shared drives, and ad-hoc spreadsheets with a single secure workspace built specifically for managed cybersecurity engagements.
Every penetration test, vulnerability scan, and incident response engagement is tracked end-to-end β from kickoff through retesting, with status, scope, and deliverables visible to your team.
Curated threat feeds filtered for Hong Kong relevance β HKCERT advisories, ransomware leak-site listings naming HK victims, and CVEs affecting the technology stack you actually deploy.
Multi-tenant isolation enforced at the database level. Encrypted evidence storage, audit-logged access, per-engagement scope gates, and role-based permissions β security posture appropriate to the data we hold.
Platform Capabilities
Capabilities purpose-built for managed cybersecurity clients β from external surface monitoring to engagement delivery.
Attack Surface Monitor
Continuous discovery and monitoring of your internet-exposed assets. Subdomains, IPs, open ports, web technologies, and exposure alerts β refreshed automatically on a daily cadence with snapshot history so you can see exactly when something changed.
Threat Intelligence
The portal surfaces curated threat intelligence β HKCERT advisories, ransomware leak-site listings, KEV-flagged CVEs, and APT campaign activity β filtered for Hong Kong relevance and your tech-stack. Critical alerts are pushed to email; full enrichment, IOCs, and historical context live here.
Threat Intelligence is also available as a standalone managed service.
Learn about the Threat Intelligence service
Engagement Management
Track active engagements through kickoff, fieldwork, reporting, and retesting. Service requests, meeting notes, deliverables, and remediation barriers β all attached to the engagement record rather than scattered across email and shared drives.
Token Wallet
Token-based engagement billing with full ledger transparency. One token equals HKD 1,000 of security service capacity. Every credit and debit is recorded and exportable, so finance and security leadership both have the audit trail they need.
Notifications
You don't need to keep the portal open. Critical events trigger immediate alerts; everything else rolls up into a curated digest delivered on the cadence your team prefers β daily for active security teams, weekly for leadership rhythms.
Vulnerability Scanning
Powered by Nessus, the portal lets you launch vulnerability scans against your own assets without waiting for an engagement to be scheduled. Pick the profile that fits the task, track progress in real time, and download the report the moment the run completes β debited automatically from your token wallet.
For Critical Infrastructure Operators
Designated Critical Infrastructure Operators face Hong Kong's Protection of Critical Infrastructures (Computer Systems) Ordinance obligations. The portal includes a dedicated scoring engine that evaluates threat events against Cap. 653 reporting criteria and tracks your readiness posture continuously β not just at audit time.
The portal handles sensitive engagement data β credentials, evidence, and findings. Security controls are appropriate to that responsibility.
Row-level security enforced at the database layer. No client sees another client's data, ever.
Distinct roles for company admin, viewer, and DracoSec internal staff. Permissions scoped to need.
Every authentication, report download, and credential rotation is logged with IP and user agent.
ASM evidence and engagement deliverables encrypted at rest. Access expires automatically.
A short onboarding designed to get your team productive within the first week of any engagement.
Your account is provisioned when your first engagement starts. No separate signup.
Add colleagues with appropriate roles β admins manage settings, viewers see reports.
Authorize ASM scopes and tune threat intel preferences to match your stack.
Receive digests, review findings, manage requests β all from one place.
Access your portal directly. New clients receive portal access automatically as part of any engagement β speak to us about what coverage fits your organization.