About
Builder and attacker, same person.
Forcent is an independent security and cloud consultancy, founded in 2018. The work splits between designing and building production platforms, and testing systems like the ones we build — which is an unusual combination, and the reason the designs hold up.
History
How we got here.
Forcent started in September 2018 in Bucharest as an independent security consultancy. The early work was almost entirely offensive: penetration testing, red team exercises, digital forensics and incident response.
The shift came from what those engagements kept surfacing. A test would find a problem that wasn’t really a vulnerability so much as an architecture decision that had aged badly, or a deployment process nobody could describe. Fixing the finding without fixing the thing underneath it meant testing the same estate again a year later and writing a similar report.
So the portfolio expanded into cloud and DevSecOps consulting, and that now makes up the majority of engagements — typically long-term, hands-on contracts rather than short assessments. Security testing continues alongside it, and the two inform each other constantly.
Most work arrives through referral and repeat clients rather than through this website. That’s a good sign about the work and a poor one about our marketing, which is roughly why this page exists.
Clients
Who we work with.
Engagements have been with banks, government agencies, healthcare organisations and technology companies across Europe and the United States, with work also spanning the UK and the UAE. Typically these are long-term, hands-on contracts where we own delivery rather than advise from the side.
On a normal engagement that means the full lifecycle: scoping and architecture design, agreeing the target infrastructure with the client and every stakeholder, hands-on implementation, coordinating and mentoring the development teams involved, and handing over a documented platform their people can run.
Who you work with
Dragoș Donici
- CertificationsOSCP (Offensive Security) · CREST CRT PEN
- United KingdomPreviously security cleared (SC) and a CHECK Team Member
- EducationBSc (Hons) Computer Science, University of Essex — First Class
- BasedBucharest, Romania · open to on-site travel
- ProfileLinkedIn
Cloud and DevSecOps consultant, security engineer and ethical hacker, with over ten years of professional experience designing, building, securing — and breaking — systems, networks and applications. Started with Linux and BSD as a teenager and never really stopped.
Before founding Forcent: lead penetration tester at HackersHub in the Netherlands, senior security consultant at MTI in the UK, and the first employee at Hacker House in Manchester, where the Hands-On Hacking course was co-developed. Earlier, a graduate scheme at BT Global Services launching security products — including finding two critical vulnerabilities in a commercial network access control product and writing working proof-of-concept exploits for them — and an industrial placement at ARM in Cambridge building technology demos shown at Mobile World Congress.
Finding 0-days in enterprise software and architecting a bank’s production platform are not usually the same CV. Holding both is what makes the threat modelling on a design something other than a checklist.
Stack
What we actually work in.
Not an exhaustive list, and not a claim that every tool is the right one. It’s what recurs across engagements.
How we work
Three commitments.
The person who scopes it, does it
No account layer, no bench of juniors behind the proposal. If we quote the work, we deliver it, and we stay reachable after handover.
We write down the reasoning
Every engagement ends with the decision record, not only the artifact. Six months on, your team should be able to tell which choices were deliberate.
We’ll tell you when it isn’t us
Being small means turning work down. If your problem sits outside what we do well, saying so on the first call costs us a project and saves you a quarter.
Next step
Scoping calls are free.
Tell us what you're dealing with. If we're not the right fit we'll say so on the call, and usually point you at who is.