Sekurno’s Cybersecurity Revolution: Trust Beyond Compliance by

Updated on: May 12, 2025

In today’s cybersecurity landscape, where the focus often shifts to ticking compliance boxes rather than truly mitigating risks, Demyd Maiornykov’s vision for Sekurno stands apart. What began as a community project in the cybersecurity space has evolved into a global company committed to building trust in technology by addressing real security threats. In this interview for SafetyDetectives, Demyd shares how Sekurno’s journey unfolded, its unique approach to security beyond compliance, and how AI is shaping their future workflows. From high-risk industries to enterprise SaaS clients, Sekurno is dedicated to providing deep, meaningful security, not just certifications. Let’s dive into his insights on how Sekurno is redefining cybersecurity.

How did Sekurno come to life, and how has the company evolved since its founding?

Sekurno actually started as a community project — not a company. It was a space where people passionate about hacking and cybersecurity could connect, learn, and challenge each other. We organized offline events, workshops, and built a really active group of practitioners. The whole idea was to foster curiosity and create a hands-on learning culture around offensive security.

Then COVID hit, and everything changed. We couldn’t organize events anymore, but by that point, the community had gained momentum — it had become a self-sustaining group with several members already working in the cybersecurity field commercially. Since we couldn’t meet offline, and we had a strong team of people who genuinely cared about security, we decided to turn it into something bigger. That’s how Sekurno — the company — came to life.

In 2021, we joined the Cyber Accelerator UA, supported by USAID’s Cybersecurity for Critical Infrastructure Program. We tried different business models, including subscription-based services, to figure out what could help us stand out. And while flexible payment terms were appreciated by clients, we realized they weren’t a true differentiator. They added value, but didn’t define us.

By 2022, we were serving clients globally, but still relied heavily on one major account. When that client ran into financial trouble and had to reduce their security budget, it was a wake-up call. We had to stop and ask ourselves: what actually sets us apart in this space?

That’s when we realized that a big part of the market was doing security just for compliance. Just to tick a box. But we’ve always believed that security should reduce real risk — not just satisfy auditors. So we made a conscious decision to work with companies that value true security over formalities.

We started focusing on whitebox pentesting, because it gives us deeper insight and allows us to find up to 30% more critical vulnerabilities than blackbox. We integrated threat modeling into every project, and built incentives for our engineers to uncover more meaningful findings. The entire approach shifted from simply testing systems to deeply understanding the client’s environment and helping them make smart, risk-based decisions.

Since then, we’ve expanded internationally, opened a LATAM office in São Paulo, and have been recognized twice by Clutch as a Global Cybersecurity Leader — among more than 7,000 cybersecurity firms.

Today, we work with high-risk industries (to clarify: HealthTech, FinTech, MilTech) and enterprise SaaS companies who truly care about their security posture. We’re not here to just help them get a badge — we’re here to help them build resilience that lasts.

And I am sharing something new as well, but we actually decide to focus now on HealthTech & FinTech industries only. You will see upcoming changes in the near future.

What sets Sekurno apart in how you identify and address security risks others often miss?

What truly sets Sekurno apart is our mission — and everything we do stems from it.

At one point in our growth, I stepped back and asked: Why are we doing this? There are thousands of cybersecurity companies out there — what makes us different?

That reflection brought me back to a personal moment. I was about to buy a DNA testing kit from 23andMe. I was excited about the technology — curious to explore my ancestry and understand the health markers in my DNA. But just before confirming the order, I paused and thought: What if someone gains access to this data? What if it’s misused? That moment of hesitation — that fear — changed how I thought about our work.

I realized that fear was standing in the way of embracing innovation. And the only way to overcome that fear is by building trust — and that trust must be rooted in real security, not check-the-box compliance.

That’s when we coined the idea of “cybersecurity beyond compliance.” Our mission is simple:

To build trust in technology, so people can embrace its full potential without fear.

And that mission became the foundation of how we operate.

How that translates into practice:

To identify and address risks others often miss, we re-engineered our entire penetration testing approach to reflect our values:

• We combine all detection methods — SAST, DAST, IAST, SCA, manual testing, and code review — because each uncovers different classes of vulnerabilities.
• Every project begins with threat modeling — a planning phase that identifies business logic threats often missed by generic testing.
• Our engineers are incentivized not just to complete the work, but to find critical vulnerabilities. We set up a bonus pool per project, which rewards depth, not just throughput.
• Each project involves at least two engineers and a technical lead, to ensure both coverage and objectivity.
• Our team blends security and software development experience — most of our engineers are former developers. When they read your code, they see both the function and the flaw.
• We implement test coverage checklists to keep engineers accountable and ensure nothing gets overlooked.
• And yes — we’re constantly innovating. Some things we’re working on will raise the bar even higher.

That’s why we consistently find risks others miss — because we design for real threats, not just minimum requirements.

The same philosophy applies to our compliance work.

With ISO, SOC 2, HIPAA, or GDPR, we don’t just help companies check off controls. We start with understanding assets, workflows, and real risk exposure, and only then select security controls that make sense for the client’s environment and risk appetite.

So whether it’s pentesting or compliance, we lead with purpose. That’s how we’ve built trust with high-risk industries — and that’s what keeps clients coming back.

How do you adapt your cybersecurity approach to high-risk industries and enterprise SaaS clients?

High-risk industries and enterprise SaaS clients require cybersecurity solutions that align with their specific business objectives. These organizations often face greater exposure and regulatory scrutiny, while also operating within confined security budgets. That makes precision and prioritization essential.

Our approach always starts with a deep understanding of the client’s goals. We don’t just ask what they want — we ask why. Why do they need a penetration test right now? In most cases, it comes down to one of three core objectives:

1. Compliance — where automated scanners may be sufficient to meet basic standards.
2. Risk Reduction — where deeper methods like whitebox testing, code reviews, and architecture analysis are critical.
3. Attack Simulation — typically done through blackbox or red teaming, to test how well security controls perform in real-world scenarios.

The distinction between risk reduction and attack simulation is important. If the goal is simulation, we don’t expect the client to whitelist our IPs — the test should mimic how attackers would actually behave and test detection mechanisms (WAFs, firewalls, IDS/IPS, etc.). But for risk reduction, our job is to go deep and find vulnerabilities before an attacker does — that’s where whitebox approaches excel.

In fact, OWASP’s ASVS even recommends code-informed testing over blackbox when the goal is true risk reduction.

Once the objective is clear, we move to the information gathering stage. If the client’s goal is to reduce risk, we collect everything we need to perform a thorough, context-aware audit. That includes:

• A walkthrough of all user flows,
• API documentation,
• Role-based access details,
• Architectural diagrams,
• An understanding of the industry and any relevant security precedents.

This is critical. In high-risk sectors, a breach can destroy a business — not just damage it. We’ve seen this before: for example, the mental health center in Finland that was breached and eventually shut down. The impact went far beyond technical — it resulted in lawsuits, reputational damage, and patient harm.

So our goal is to know the environment as well as — or better than — the attacker might. That’s how we can uncover nuanced threats and design tests that truly protect the business.

In short, our approach is consultative and adaptive: we work to optimize the budget, tailor the methodology to the client’s true objectives, and ensure we deeply understand their application workflows, infrastructure, and attack surface. That’s what allows us to deliver security that’s not only effective, but relevant.

In what ways does AI enhance your threat modeling, reporting, and security workflows?

We see AI — particularly large language models (LLMs) — as a powerful enabler, not a replacement. At Sekurno, we currently apply AI in three core areas of our security workflow: threat modeling, reporting, and operational workflows. Additionally, we’ve implemented a clear framework to manage the privacy and risk implications of using these tools responsibly.

1. Threat Modeling

One of the most transformative applications of LLMs has been in threat modeling.

• LLMs help us interpret application architecture — from flowcharts to diagrams and design documentation — allowing us to understand how systems work and where their boundaries lie.
• Using structured frameworks like STRIDE, AI assists in generating potential threats, including attack vectors across trust boundaries and privilege escalations.
• It helps us identify key assets, define trust zones, and anticipate likely attacker paths early in the engagement — which is especially valuable in whitebox and risk-reduction assessments.

This drastically reduces the time needed to get a comprehensive threat model in place — and allows our engineers to focus on validating and customizing those threats with real-world impact.

2. Reporting

Another area where AI excels is in streamlining our reporting process, without sacrificing depth or clarity.

• LLMs can generate tailored code snippets — whether it’s a proof-of-concept for exploitation or a secure remediation example that devs can plug in directly.
• We use AI to summarize findings into role-specific formats: engineers get actionable, technical remediation guidance, while executives receive concise, risk-focused summaries.
• This doesn’t just speed up reporting — it enhances clarity, consistency, and delivery across every engagement.

What used to take hours of formatting and phrasing now gets done faster — freeing our experts to focus more on analysis, less on presentation.

3. Security Workflows

We’re also integrating LLMs into our day-to-day security workflows, including red teaming and developer support.

• For red teams, LLMs act as creative partners — helping brainstorm novel attack vectors, privilege escalation paths, and social engineering angles.
• AI also supports alert correlation and triage, especially when sifting through large volumes of logs or signals from detection systems.

By embedding AI into these processes, we turn it into an intelligent assistant — helping us move faster, think broader, and focus deeper.

4. Data Privacy & Responsible Use

Of course, we take the privacy and confidentiality of client data extremely seriously — and that governs how we use AI at every step.

• When working with sensitive or regulated data, we use locally hosted or private LLMs to ensure full control over data input and output.
• In cases where public or third-party models are used, all sensitive information is redacted or anonymized before interacting with the model.
• We also implement access controls and usage monitoring around AI tooling to ensure secure and auditable usage across our team.

Final Thoughts

For us, AI is not just a shiny new tool — it’s an accelerator of real work. It enhances creativity, precision, and speed in areas that matter most.

By combining human expertise with intelligent automation — and doing so responsibly — we’re able to deliver better outcomes, faster for our clients.

How do you make sure compliance efforts also lead to strong, real-world security for your clients?

That’s a great question — and one we think about a lot.

At Sekurno, we believe compliance provides a valuable foundation, but the real impact comes from how you implement it. The goal shouldn’t just be to pass an audit, but to build resilience and trust through security that works in the real world.

To make this happen, we focus on two critical pillars:

1. Consultancy, and
2. Selection & implementation of security controls.

1. Consultancy: Prioritizing What Actually Matters

Every organization has limited budgets — and when security controls are selected poorly or applied generically, the result is wasted resources and weakened defenses. Unfortunately, compliance frameworks often provide broad requirements that can create room for misaligned or ineffective implementation.

That’s where strong consultancy comes in.

Before recommending or implementing any controls — even if they’re listed in ISO 27001, SOC 2, or HIPAA — we start by understanding the client’s:

• Business objectives,
• Industry,
• Compliance landscape,
• Types of information handled,
• And their broader risk exposure.

We help them classify their data and map which assets store, process, or transmit each type of information. This process results in a structured, data-informed asset inventory — not just a spreadsheet of servers, but a prioritized view of what truly needs protecting.

We also factor in contextual risk drivers — like geopolitical changes, insider threats, or evolving threat actor motivations. For example, during times of war or instability, certain clients become targets of opportunity or ideology, and they need to account for that. We bring in historical precedent from their industry and region to help them understand which risks are likely to recur.

This insight allows us to design a risk management strategy that’s informed, realistic, and grounded in both current threats and future resilience — including business continuity plans.

2. Smart Selection & Validation of Security Controls

Selecting the right security controls goes far beyond drafting policies. We help clients carefully choose the actual technologies and tools that matter — including:

• Antivirus and endpoint protection,
• Firewalls and intrusion detection systems,
• SIEM platforms,
• MDM (mobile device management) solutions,
• Logging, backup, and monitoring systems.

Each of these tools comes with costs, integration challenges, and performance tradeoffs. That’s why we guide clients through a thorough assessment and tailored selection process, ensuring that each control matches their environment, assets, and risk appetite.

But selection is only the beginning. We follow the Plan → Do → Check → Act approach to make sure controls aren’t just deployed — they’re functional and effective.

If a system doesn’t deliver the expected security outcomes, we help adjust it — whether that’s reconfiguring a tool, updating playbooks, or replacing a control altogether. Implementation without measurement isn’t security — it’s just decoration.

We’ve even started integrating assurance controls into our compliance workflows. For example, we now offer phishing simulations as a standard part of certain compliance engagements. Why? Because we want to check:

1. Whether technical systems like spam filters and reporting tools are effective; and
2. Whether users can spot and respond to attacks — even after they’ve read the policy and completed awareness training.

That’s how we close the loop between policy, control, and behavior — and that’s where real-world security lives.

Real Security, Not Just Paper Security

In short, we make sure compliance is not the end goal, but a byproduct of a real, risk-aware security program. Our job is to guide clients away from default paths that meet the bare minimum — and toward security decisions that matter for their business, their people, and their future.

That’s how compliance becomes a strength — not a distraction.