Technology & Cybersecurity Company: Build. Secure. Operate.
Onion Infosec engineers technology, secures it and keeps it running, with the engineers who build a system and the specialists who secure it working as one team. Cybersecurity, AI, software, cloud, IT and OT (operational technology), for technology and security leaders wherever they operate.
Position
What Onion Infosec does
We bring specialists in each field under one roof, so the experts who secure a system work alongside the experts who built it.
Most organizations buy building, securing and running technology from different suppliers, then manage the gaps between them.
A matrix of four lifecycle stages against five technology domains. Build: product and platform engineering for software, LLM, RAG and agent systems for AI, landing zones and platforms for cloud, infrastructure and workplace for IT. Secure: application security, AI security testing, cloud security, identity and data security, and OT segmentation to IEC 62443, with penetration testing and governance, risk and compliance across every system. Operate: application support, AI evaluation and monitoring, cloud operations, managed IT and OT monitoring, with a 24 by 7 managed SOC and incident response fed by telemetry from every system. Improve: Security Labs research, detection engineering, security automation and the security products. What operations teach returns to the next build.
- One system, followed through its life
- What operations teach returns to the build
- A service, linked to its page
01Services
Seven service lines. Choose one to see what it covers.
Cybersecurity
Security advisory, offensive testing, application security, protection engineering, 24×7 detection and response, and incident response.
Advisory & GRC
Cybersecurity risk assessment · Security assessments and audits · Security architecture
Offensive Security
Web application penetration testing · Mobile application penetration testing · API penetration testing
Application Security
Secure SDLC · Threat modeling · DevSecOps and pipeline security
Identity, Cloud & Data Protection
Identity security · Zero trust · Email security
Detection & Response
Managed SOC and 24×7 security monitoring · Managed detection and response (MDR) · SIEM engineering and management
Threat Intelligence
Threat intelligence reporting · Dark web monitoring · Indicator enrichment
Incident Response & Forensics
Incident response · Digital forensics (DFIR) · Malware analysis
AI
AI strategy, LLM and RAG engineering, agents, automation, AI security testing and governance, taken from use-case selection to monitored production.
AI strategy and readiness
AI use-case assessment · Data readiness review · Build, buy or configure analysis
AI engineering
AI application development · Generative AI solutions · LLM integration
AI automation and integration
Workflow automation with AI · Intelligent document processing · Enterprise system integration
AI infrastructure and observability
Model serving and hosting · LLMOps pipelines · Vector and data infrastructure
AI security
LLM security · AI threat modeling · AI red teaming
AI governance and risk
AI risk assessment · AI usage policy · AI system inventory
AI for security operations
AI-assisted SOC · Security automation · Alert enrichment pipelines
Software & Product Development
Product discovery, web and mobile applications, SaaS platforms, APIs, modernization, QA and DevSecOps, with security checks inside the delivery pipeline.
Product discovery and UI/UX design
Product discovery · Technical feasibility study · UX research and information architecture
Web and mobile applications
Web application development · Frontend engineering · Native mobile development
SaaS and enterprise software
SaaS product engineering · MVP development · Enterprise application development
API, backend and full-stack engineering
API design and development · Backend and microservices engineering · Full-stack delivery
Application modernization
Legacy application assessment · Re-architecture and refactoring · Framework and runtime upgrades
QA and testing
Test strategy and planning · Test automation · Functional and regression testing
DevOps, DevSecOps and CI/CD
CI/CD pipeline engineering · Infrastructure as code and environments · DevSecOps implementation
Cloud
Cloud strategy, migration, platform engineering, security, operations, cost optimization and disaster recovery on Azure, AWS and Google Cloud.
Cloud strategy and architecture
Cloud readiness assessment · Cloud strategy and business case · Landing zone design
Cloud migration
Discovery and dependency mapping · Migration planning · Workload migration
Cloud-native and platform engineering
Infrastructure as code · Kubernetes platform engineering · Containerization
Cloud security
Cloud security assessment · Cloud IAM and entitlements · CSPM implementation
Cloud operations and monitoring
Managed cloud operations · Monitoring and observability · Site reliability engineering
Cloud cost optimization
Cost visibility and allocation · Rightsizing and scheduling · Commitment planning
Backup and disaster recovery
Recovery objectives and impact analysis · Backup architecture · Immutable and isolated backups
IT
Infrastructure, networks, endpoints, identity, Microsoft 365, patching, backup and IT architecture, run with security as the default configuration.
Infrastructure & Servers
Server management · Virtualization and hybrid infrastructure · Storage and file services
Networks
Network design and segmentation · Firewall and VPN management · Switching, routing and wireless administration
Endpoints & Asset Management
Endpoint management · Mobile device management · Endpoint protection deployment
Identity & Directory
Microsoft Entra ID administration · Active Directory operations · Identity lifecycle automation
Microsoft 365
Tenant administration · Exchange Online and email · Migration to Microsoft 365
Monitoring, Patching & Hardening
Infrastructure monitoring · Patch management · Hardening baselines
Backup & Disaster Recovery
Backup design and implementation · Restore testing · Disaster recovery planning
IT Consulting & Architecture
IT assessment and roadmap · Infrastructure architecture · IT security architecture
OT
Security for industrial control systems and SCADA: assessment, asset visibility, segmentation, secure remote access, monitoring and incident response.
OT security assessment and risk
OT security assessment · IEC 62443 risk assessment · Consequence-based risk analysis
Asset discovery and visibility
Passive asset discovery · Configuration and project file analysis · Selective active querying
Network architecture and segmentation
OT reference architecture · Zones and conduits design · Industrial DMZ design
Secure remote access
Remote access assessment · Remote access architecture · Vendor and third-party access control
OT monitoring and threat detection
OT network monitoring deployment · Baseline and anomaly detection · Detection engineering for ICS
OT incident response
OT incident response planning · Playbooks for OT scenarios · Tabletop exercises
Standards and regulatory alignment
IEC 62443 gap assessment · NIST SP 800-82 alignment · OT security policies and procedures
Managed Services & Support
Ongoing operation of security, IT, cloud and applications under a service agreement, with 24×7 monitoring and support options.
Managed Security
24×7 security monitoring · Managed SOC · Managed detection and response (MDR)
Managed IT
Infrastructure operations · Network operations · Endpoint operations
Managed Cloud
Cloud operations · Infrastructure as code maintenance · Cloud monitoring and observability
Service Desk & Remote Support
Service desk · Remote support · Security-aware request handling
Application Support
Application monitoring · Tiered application support · Release and deployment support
Maintenance
Patch management · Backup monitoring · Health checks
Incident Support
Major incident management · Security incident escalation · Incident response retainer
02Products
We don’t only use security technology. We are building it.
Built in-house
OSI – Onion Super Intelligence. Protect. Govern. Discover.
OSI, Onion Super Intelligence, is the product platform behind our security products, all of them in development: AEGIS, being built to protect; JANUS, to govern; ARGUS, to discover. A dedicated product team builds them in-house, with design-partner conversations open.
The OSI platform- ProtectExtended Detection & Response
AEGIS
Intelligent threat detection, investigation and response across endpoint, identity, cloud and network environments, from one security intelligence layer.DetectCorrelateInvestigateHuntRespondExplore AEGIS - GovernGovernance, Risk & Compliance
JANUS
Risks, controls, policies, evidence and compliance requirements connected in one system, for a continuous view of security and compliance posture.FrameworksControlsEvidenceRiskReadinessExplore JANUS - DiscoverAI Discovery · AI Risk Intelligence
ARGUS
Visibility into the AI applications, users, usage patterns and shadow AI across an organization, and the security and governance risks that follow.DiscoverInventoryAssessMonitorReportExplore ARGUS
03Industries
Industries we work in
The sector decides what matters. We work in
04Reach
Serving India and the world.
We work with organizations wherever they operate, and our client base is expanding across the GCC (Gulf Cooperation Council), APAC (Asia-Pacific), Europe, the USA and beyond. Delivered remotely and on site from our head office in Mumbai, India.
USA
Europe
GCC
APAC
USA
Mumbai, India
- Head office
- Expanding into
- Head office
- Mumbai, India. Engagements are led from here and delivered remotely and on site.
- Your market
- We work to the requirements of the market you operate in: India’s DPDP Act, CERT-In directions and the RBI and SEBI CSCRF frameworks, GCC national frameworks such as NCA ECC and SAMA CSF, and US, EU and APAC requirements. See the frameworks we work to.
- Expanding
- Our client base is expanding across the GCC, APAC, Europe, the USA and beyond. Work is delivered remotely and on site, so location is rarely the constraint. Wherever you are, talk to us.
05Security Labs
Research that starts from delivery work.
Questions raised by client work are researched properly here: how a technique behaves, how to detect it, what can be automated. The results return to our services and feed our products.
Security Labs- LAB/01
Threat Research
Study of intrusion techniques and the telemetry they leave, so that detection and response work starts from evidence.
- LAB/02
AI Security
Research into how AI systems fail under attack, how to test them repeatably and how to evaluate AI used in security work.
- LAB/03
Detection Engineering
Detection content built, tested and maintained as software, with coverage reported as it is and not as it is mapped.
- LAB/04
Security Automation
Research and engineering on which security work can be automated safely, and how to keep automation auditable and reversible.
- LAB/05
Vulnerability Research
Study of recurring flaw classes in applications, components and boundary devices, handled under coordinated disclosure.
For partners
White-label partner program
Offer our services under your name.
MSPs, consultancies and agencies use our engineers on a white-label basis, and keep the client relationship.
06How we work
Four principles, and methods you can check.
Our work follows published frameworks, so it can be verified against them. Members of our team hold OSCP, CISSP, CISM, CEH, CHFI and more.
About the company01
Integrity
The highest ethical standards in every engagement. We recommend only what your risk justifies.
02
Technical rigor
Evidence-based findings and reproducible methods. If we cannot demonstrate it, we do not report it.
03
Confidentiality
Every engagement is governed by non-disclosure agreements and controlled handling of your information.
04
Outcomes
We measure success by the improvement in your systems and security, not by the volume of findings.
Testing and detection
Governance and assurance
AI
Industrial
The company
Onion Infosec is the trading name of Onion Information Security Solutions Private Limited, a technology and cybersecurity company incorporated in 2025 and headquartered in Mumbai, India. It works with organizations wherever they operate, and delivers work remotely and on site. See about Onion Infosec and how we handle client information.
07Resources
Technical thinking, written down.
- Read article
Why security operations need context, not more alerts
Why alert volume says little about SOC outcomes, what context an analyst needs to decide quickly, and how to measure triage without counting alerts.
- Read article
Building a practical cloud security monitoring strategy
A practical order of work for cloud security monitoring on AWS, Azure and Google Cloud, from control plane logs to detections, cost control and response.
- Read article
Detection engineering: turning security telemetry into action
How to run detections as code, from an ATT&CK hypothesis through a tested KQL rule to tuning and analyst notes, with a worked Microsoft Sentinel example.