Find out what an attacker can do with your systems before they find out first.
A pentest is an authorized exercise in which we attempt to compromise your systems using the same techniques a real attacker would, within an agreed scope and under written rules of engagement. This is not an automated scan: exploitation is manual and every finding is verified to rule out false positives. We work from Bogotá across Colombia and LatAm, backed by 29 years of experience, ISO/IEC 27001:2022 and ISO/IEC 9001:2015 certification and EC-Council ATC accreditation.
29
years of offensive security experience across LatAm
SecPro
9
countries served from Bogotá, Panama and Virginia
SecPro
ISO 27001
ISO/IEC 27001:2022 certification issued by SGS
SGS
Engagement types
Not every company needs the same test. These are the engagement types we run and when each one makes sense. If you don't know where to start, external pentesting is the right answer in the vast majority of cases.
From the Internet with no credentials, like any attacker. Covers your perimeter: websites, VPN, mail, exposed services and assets you didn't know were published. The usual starting point.
We start from inside the network, simulating an employee, a supplier or an already-compromised host. Measures how far someone can get: Active Directory, segmentation, escalation to domain admin.
Manual review aligned with OWASP Top 10 and ASVS, authenticated and unauthenticated, per role. Business logic, access control, injections and session management. Includes dependency SCA and SBOM.
REST and GraphQL against the OWASP API Top 10: BOLA, BFLA, broken object-level authorization, business-flow abuse and rate limits. We start from your OpenAPI spec when one exists.
iOS and Android under OWASP MASVS: local storage, communications, anti-tampering, embedded secrets and the API behind the app.
AWS, Azure and GCP: IAM configuration, escalation paths between roles, storage exposure, Kubernetes and containers, benchmarked against CIS.
Corporate Wi-Fi: WPA2 and WPA3, 802.1X, poorly segmented guest networks, rogue access points and evil twin attacks inside your premises.
Targeted phishing, vishing and pretexting to measure the human factor and use it as an initial access vector, always with prior agreement on how employees are treated.
Pricing depends on the number of in-scope assets and the type of test, not on company size. The factors that move the number are: how many IPs or domains are included, whether the application has multiple user roles, whether on-site work is required and whether retesting is included. A scoped external perimeter pentest is the most affordable entry point; an internal Active Directory pentest or an application with complex business logic costs more because it requires more analyst days. We quote with a closed scope and a fixed price, with no per-finding charges.
Typical execution runs from one to three weeks depending on scope, plus about a week for reporting. A small external perimeter can be completed in a few days; a web application with several roles or a large internal network takes longer. The exact schedule, including the report delivery date, is set in the proposal before we start.
A vulnerability assessment is automated: a scanner returns a list of potential flaws, false positives included, without confirming whether they are exploitable. A penetration test adds the manual work of an analyst who actually exploits those flaws, chains them together and demonstrates real business impact. A scan tells you a door looks unlocked; a pentest opens it and shows you what is inside. That is why a pentest report carries reproducible evidence rather than theoretical severities.
At least once a year, and additionally after any significant change: a new application in production, a cloud migration, an architecture change or a merger. If you need to comply with ISO/IEC 27001, PCI DSS or Colombia's Circular 007 from the Superintendencia Financiera, annual frequency is usually the documented minimum.
The risk is not zero, which is exactly why it is managed in writing beforehand. We agree execution windows, out-of-scope systems, a contact for immediate stop and which test types are excluded — denial of service, for example, is not part of a standard pentest. In sensitive environments we work against pre-production first. Across 29 years of operation, that is the practice that lets us test production without disrupting it.
For an external pentest, just the list of in-scope domains and IPs plus signed authorization from the system owner. For an internal pentest, a network access point or a host with connectivity. For an application, credentials for each user role and, where available, the OpenAPI specification or functional documentation. If assets sit with a cloud provider, prior notification may be required.
Yes. Alongside the executive and technical reports we issue an attestation letter stating the tested scope, the dates and the methodology applied. This is the document typically requested by corporate clients, ISO/IEC 27001 auditors and vendor due-diligence processes. After the retest, the letter can reflect the findings already remediated.
Yes. Our main office is in Bogotá (Calle 100 N 10-59, Of. 301) and most of the work is remote, so we serve companies in Medellín, Cali, Barranquilla and the rest of the country with no travel surcharge. We also operate in Argentina, Bolivia, Chile, Ecuador, Mexico, Panama, the Dominican Republic and the United States, with our own offices in Panama City and Virginia. On-site work is quoted separately only when the scope requires it, as with a wireless pentest.
Schedule a free consultation and receive an external cybersecurity assessment with no commitment.
Schedule Free AssessmentEnd-to-end APT simulation, external/internal pentesting and continuous Attack Surface Management aligned with MITRE ATT&CK.
AWS, Azure and GCP pentesting. Kubernetes, containers, serverless, IAM hardening and validation against CIS Benchmarks.
Web pentesting, DAST, SAST, SCA, SBOM generation and manual review aligned with OWASP Top 10 and ASVS.
OWASP API Top 10, BOLA/BFLA, authentication, rate limits, JWT and shadow-API detection across REST, GraphQL and gRPC.
iOS and Android pentesting, binary analysis, OWASP MASVS, reverse-engineering and MITM protection.
Assessment of SCADA, PLCs, IoT/IIoT devices, industrial protocols and IT/OT segmentation under IEC 62443.
Phishing, vishing, smishing and physical-intrusion campaigns plus gamified training — 80% hands-on, 20% theory.
Surface/Deep/Dark Web monitoring, fake domains, leaked credentials and takedown coordination.
In-person and online courses in offensive and defensive cybersecurity. EC-Council ATC with field-practitioner instructors.
Need help with your cybersecurity? 💬