Services | EastSun Security

01 / RED TEAM

Red Team Consulting

We simulate the tactics, techniques, and procedures of real attack groups to test detection and response capability under real conditions, using MITRE ATT&CK-based scenarios across the full attack chain.

Real-World Attack SimulationPhishing, social engineering, and physical intrusion scenarios to comprehensively test defenses
APT Scenario-Based TestingAttack scenarios mapped to the MITRE ATT&CK matrix to verify detection of advanced persistent threats
Security Control Bypass AssessmentTesting detection bypass against EDR, SIEM, and SOC, and measuring Blue Team response speed and accuracy
Attack Path Analysis & Hardening RoadmapVisualizing successful attack paths and providing a prioritized security hardening roadmap

02 / PENTEST

Vulnerability Assessment & Penetration Testing

From web, mobile, and network infrastructure to industrial control systems (SCADA), we combine automated scanning with manual, expert-driven analysis to identify real, exploitable risk.

Internal & External Penetration TestingAttacker-perspective network intrusion scenarios to verify real-world attack feasibility
Application Security AssessmentIn-depth analysis of web, mobile, and API vulnerabilities based on OWASP Top 10 and business logic flaws
Infrastructure & Endpoint AssessmentConfiguration and vulnerability review across servers, network equipment, PCs, and mobile devices
SCADA Assessment & Incident ResponseVulnerability analysis of industrial protocol-based control systems and root-cause response for security incidents

03 / PRIVACY

Privacy & Certification Consulting

We help organizations comply with domestic and international privacy regulations, including Korea's Personal Information Protection Act and GDPR, and support ISMS-P certification.

ISMS-P Certification ConsultingAnalysis of certification criteria and structured support through control implementation and audit
Privacy Impact AssessmentAssessing privacy risk before launching new services or systems and proposing protective measures
Risk Analysis & Protection FrameworkAnalyzing risk across the full personal data lifecycle and designing technical and managerial safeguards
GDPR Response ConsultingGap analysis against EU GDPR, DPO advisory, and legality review for cross-border data transfers

04 / ISMS

Information Security Management System

We support certification and maintenance of ISMS, ISO 27001, TISAX, and CSAP, and help organizations structure security governance and risk management frameworks.

ISMS / ISO 27001 CertificationEnd-to-end support from gap analysis and implementation planning to certification audit response
Security Strategy & RoadmapMid- to long-term information security strategy and execution roadmap aligned to business goals
Security Governance & PerformanceEstablishing security organization, policy, and KPIs to make security posture measurable
Risk Analysis & SOC DesignAsset-based risk analysis and end-to-end support for in-house SOC design and build

05 / OT SECURITY

Process Security Consulting

Specialized security consulting for OT environments in energy, chemical, and manufacturing settings — identifying cyber threats to SCADA, DCS, and PLC systems under IEC 62443.

Energy Sector Vulnerability AssessmentOT network and control system vulnerability diagnosis and risk assessment for power and petrochemical plants
Secure Design for Overseas PlantsBuilding security architecture into new overseas plant construction from the design stage
Industrial Security CertificationAnalyzing requirements and roadmapping certification for TISAX, IEC 62443, and NERC CIP
OT/IT Convergence Security StrategyIT-OT boundary analysis, industrial firewall design, and secure remote access strategy

06 / TRADE SECRETS

Trade Secret & Core Technology Protection

Consulting to systematically protect core technology assets and nationally designated core technologies under Korea's Industrial Technology Protection Act and Unfair Competition Prevention Act.

Leak Prevention Framework DesignIdentifying on/offline leak paths and designing DLP, DRM, and network segmentation controls
Core Technology Protection & Audit ResponsePreparing protection plans and verifying compliance for government inspections
Change Management & Awareness StrategyCulture-fit security awareness programs that build a self-sustaining security culture
Technology Leak Incident ResponseDetection of suspected leaks, digital forensics support, and legal response procedures

AI Security Solutions

AI-Powered Security Products

Beyond consulting, we build AI products that put security expertise into daily engineering and knowledge workflows.

ESSCODE

AI Source Code Security Platform

An LLM reads and understands your code — tracing data flow and business logic instead of matching static rules — to cut false positives and suggest concrete fixes, with on-premise deployment for closed networks.

ESSRAG

AI Enterprise RAG Platform

Hybrid semantic + BM25 search with Korean reranking turns scattered PDF, Word, and Excel documents into a system that understands and answers, including a built-in CVE/CVSS vulnerability search.

Process

Our Process

A systematic process from initial consultation to post-remediation follow-up.

STEP 1

Initial Consultation

We discuss scope, schedule, and testing methodology together with the client.

STEP 2

Testing & Assessment

We perform penetration testing or assessment within the agreed scope.

STEP 3

Results Report

We provide a detailed report covering discovered vulnerabilities, risk levels, and remediation measures.

STEP 4

Remediation Verification

We re-verify that remediation actions have been implemented to finalize the engagement.

Have questions about our services?

We're happy to consult on assessment and consulting scoped to your project and timeline.

We diagnose like an attacker,and solve like a defender