Cybersecurity companies in Colombia: how to choose without getting it wrong

If you searched for «cybersecurity companies in Colombia» you've probably found several «top 10» lists. It's worth knowing where they come from: most are commercial directories, where the ranking depends on who pays or on how many employees a company declares in its profile, or they are guides written by a provider that conveniently appears in its own list. Neither is inherently wrong, but neither is an independent evaluation.

This guide is written by one of those companies — SecPro — and we're saying so upfront. What follows is the criteria we ourselves use when we subcontract, and what experience shows separates a serious provider from the rest. It includes the cases where we are not the right choice.

First: what type of provider do you actually need

The most expensive mistake isn't picking the wrong company, it's picking the wrong category. Five types of provider operate in Colombia and they do different things, even though all of them market themselves as «cybersecurity».

• Offensive security (pentesting and Red Team). They tell you how someone could get in. Project work, delivered as a report. This is what you need to know your real exposure, when a client demands a pentest, or before an application goes to production.
• MSSP and managed SOC. They monitor your infrastructure continuously and respond to incidents. Recurring service with a monthly fee. This is what you need if nobody is watching the alerts at 3 a.m.
• Compliance consulting. They take you to ISO/IEC 27001 certification, or to compliance with the Superintendencia Financiera's Circular 007 or the data protection regime. They produce policies, procedures and evidence for the auditor.
• Integrators and resellers. They sell and deploy third-party technology: firewalls, EDR, SIEM, DLP. Their business is the licence; the service is usually the wrapper.
• Training. They certify and train your team. It's the only category that addresses the cause rather than the symptom, and the one most often postponed.

An integrator won't deliver a good pentest, and an offensive boutique won't run your 24/7 SOC. When a provider claims to do all five equally well, they usually subcontract four. Asking which one is the core business — and who executes the rest — saves a lot of time.

Eight criteria to compare, and how to verify each one

1. Who does the work, by name

This is the question that separates providers most sharply. A senior consultant handles the sale; a junior may show up for delivery. Ask for the profile and certifications of the specific people who will be on your project, not of the team in the abstract, and ask for it in writing in the proposal. A serious provider has no problem naming them.

2. Whether the «pentesting» is manual or a scanner under another name

This is the most common misrepresentation in the market and it's easy to detect. An automated vulnerability assessment costs a fraction of a pentest, and some sell the former at the price of the latter. The difference: a scanner returns a list of potential flaws, false positives included; a pentest actually exploits them, chains them together and demonstrates impact.

How to verify: ask for an anonymized sample report. If findings come with generic tool text, severities with no business context and no reproducible steps or screenshots, it's a scan. A real report explains how two minor flaws were chained into something serious — and no tool writes that on its own.

3. That the certification actually exists

An ISO 27001 logo on a website proves nothing: anyone can paste it. What proves something is the certificate with its number, the certifying body and the scope.

How to verify: ask for the PDF certificate and check it in the certifier's public directory — SGS, Bureau Veritas, ICONTEC and AENOR all have online search tools. Look at two things: that it is current, and above all the scope. Certification frequently covers only one process or one site, not the whole operation. Also distinguish the company certificate (ISO 27001, which attests to the management system) from individual certifications (CEH, OSCP, CISSP, CPENT), which attest to the analyst.

4. Legal presence in Colombia and the contractual framework

A pentest involves accessing third-party systems without prior authorization — conduct criminalized in Colombia by Ley 1273 de 2009, which added computer crimes to the Criminal Code. What makes the exercise lawful is written authorization from the system owner. That is why a Colombian contract matters, with a NIT, a confidentiality agreement and a signed rules-of-engagement document before anything starts.

If you will hand over personal data, that processing falls under Ley 1581 de 2012, enforced by the Superintendencia de Industria y Comercio. Ask where your reports are stored and for how long. A provider with no legal entity in the country complicates contractual liability if something goes wrong.

5. Whether they understand your regulated sector

If you are supervised by the Superintendencia Financiera, Circular Externa 007 de 2018 applies to you: issued on 5 June 2018, it added Chapter V to Title IV of Part I of the Circular Básica Jurídica and set concrete requirements — a policy approved by the board, a dedicated cybersecurity unit, continuous monitoring, SIEM-style event correlation, incident reporting and continuity testing that simulates cyberattacks. And one point that gets overlooked: the supervised entity is also answerable for its third parties' risks, so if you are a technology supplier to the financial sector, this reaches you even without direct supervision.

A provider who can't cite the regulation that applies to you will produce a report your auditor can't use. Ask directly which clauses the proposed work covers.

6. What the price includes, and the retest in particular

Two quotes showing the same number can be very different. Check whether they include: a retest after you remediate (without it you don't know whether the fix worked), an executive report alongside the technical one, a results walkthrough session, and an attestation letter covering the tested scope — the document your own clients and auditor will ask for.

Be wary of per-finding pricing: it rewards padding the list with trivia. And be wary of a fixed price quoted before scope has been discussed: it means they don't yet know what they'll be testing.

7. References of your size and your sector

Almost nobody can name security clients, and that's reasonable — it's part of the confidentiality agreement. What you can ask for is a phone reference from a company of comparable size and sector, even if unnamed in the proposal. A provider with history can produce one. Resemblance to your case matters more than the logo: protecting a bank and protecting an industrial plant running PLCs have almost nothing in common.

8. What happens when they find something critical at 7 p.m. on a Friday

A good contract defines an immediate notification channel for critical findings, without waiting for report delivery. Ask about it explicitly. The answer tells you a lot about how they work.

Red flags

• They guarantee you won't be attacked. Nobody can. Anyone promising it is selling reassurance, not security.
• They quote a pentest without asking about scope. Without knowing how many assets, how many user roles and which technology, the number is invented.
• The sample report is a tool export. See criterion 2.
• Certification logos with no number or verifiable scope. See criterion 3.
• Pressure to sign at a discount that expires Friday. Security isn't bought on sales urgency.
• They won't sign rules of engagement. It protects both sides; anyone avoiding it hasn't run many projects.
• One kind of solution for everything. If the diagnosis always ends in the product they resell, it isn't a diagnosis.

Five questions for the first call

1. Which of the five types is your core business, and which parts of this proposal do you subcontract?
2. Who, by name and certification, will execute my project?
3. Can you send me an anonymized sample report?
4. Are the retest and the attestation letter included in this price?
5. Which clauses of the regulation that applies to me does this work cover?

If all five are answered without evasion, you're talking to a serious provider — ours or not.

Where SecPro fits, and where it doesn't

We are an offensive security and training firm: pentesting, Red Team, application security, APIs, cloud, OT/ICS and training. We operate from Bogotá across Colombia and in eight more countries in the region, with 29 years of experience, ISO/IEC 27001:2022 and ISO/IEC 9001:2015 certification issued by SGS and accreditation as an EC-Council Authorized Training Center. Exploitation in our projects is manual, retesting is included and we issue an attestation letter.

And what we don't do: we don't run a 24/7 SOC and we aren't technology integrators. If what you need is continuous monitoring with analysts permanently on call, or to buy and deploy EDR across 2,000 endpoints, there are companies in Colombia better equipped for that than we are, and the honest thing is to say so. Likewise, if your organization still lacks an asset inventory and patch management, a pentest will produce a devastating and not very useful report: that money goes further starting with the basics.

If offensive security is what you're after, the detail on scopes, methodology and deliverables is on our penetration testing page, and the difference from an objective-driven exercise is on Red Team and adversary simulation.

In short

Choose the provider category first and the company second. Verify certifications in the certifier's directory, not on the provider's website. Ask for a sample report: it's the only document that distinguishes manual work from a resold scan. Confirm the retest is included. And insist they name the people who will do the work.