Find the weak points before an attacker does
Penetration testing, attack simulation and actionable reports for your applications, cloud and team. Built on OWASP and other recognized standards.
Built on the standards that matter
Our methodology follows the references the security industry uses, with attention to the regulations that apply in Peru and the USA.
Methodology
- OWASPThe reference for web, API and mobile application security: Top 10, testing guide and verification standards.
- NIST SP 800-115The US technical guide to information security testing and assessment.
- PTESThe Penetration Testing Execution Standard: the phases of a test, from scoping to reporting.
- MITRE ATT&CKA knowledge base of real attacker tactics and techniques, used to design attack simulations.
- CIS BenchmarksConsensus configuration baselines for hardening cloud and systems.
- CVSSThe Common Vulnerability Scoring System, used to rate the severity of findings.
Regulations and frameworks we work with
- Ley 29733 and DS 016-2024-JUSPeruPeru's personal data protection law and its regulation, which require technical, organizational and legal security measures.
- NTP-ISO/IEC 27001:2022PeruPeru's national standard for information security management systems.
- SBS Resolution 504-2021PeruInformation security and cybersecurity management rules for entities supervised by the SBS.
- PCI DSSUSAThe payment card industry standard. Requirement 11.4 calls for internal and external penetration testing at least every 12 months and after significant changes.
- NIST Cybersecurity FrameworkUSAA widely used US framework to manage cybersecurity risk.
Our assessments produce technical evidence. Compliance is decided by the regulator or your auditor.
Services
Defined engagements, scoped to what you need to protect.
Web & API penetration testing
Manual testing the way an attacker works
We test your application with and without a user account: authentication, access control, business logic and injection. Every finding is validated by hand, not just reported by a scanner.
What we test
- Authenticated and unauthenticated testing
- Access control and business-logic abuse
- REST and GraphQL API testing
- Coverage mapped to the OWASP Top 10
- You receive
- An executive summary, technical findings with evidence and steps to reproduce, and a retest of the fixes.
- Based on
- OWASP Top 10 · OWASP WSTG · OWASP API Security Top 10
Mobile app security assessment
Android and iOS, from the device to the backend
We review how your app stores data, talks to your servers and resists tampering, and we test the backend it depends on.
What we test
- Local data storage and secrets
- Network traffic and certificate handling
- Authentication and session management
- Backend API testing
- You receive
- A technical report with evidence, severity ratings and fix guidance.
- Based on
- OWASP MASVS · OWASP MASTG
Cloud & infrastructure security review
AWS and GCP configuration, reviewed the way an attacker would
We look for the misconfigurations that turn into incidents: open storage, excessive permissions, exposed services and missing logs.
What we test
- Identity and access (IAM) review
- Storage and network exposure
- Hardening against recommended baselines
- Logging and alerting coverage
- You receive
- Prioritized findings with the exact configuration to change.
- Based on
- CIS Benchmarks · each provider's best practices
Attack simulation
Controlled scenarios that chain real techniques
We simulate how an attacker would move: phishing, credential attacks and paths between systems. The goal is to see what your team detects and how fast it responds.
What we test
- Phishing and credential scenarios agreed in advance
- Attack paths mapped to MITRE ATT&CK
- Detection and response gaps
- Rules of engagement signed before starting
- You receive
- A report per scenario: what worked, what was detected and what to improve.
- Based on
- MITRE ATT&CK
Secure code review & DevSecOps
Fix the cause, not only the symptom
We review the critical code paths and harden your pipeline so vulnerabilities are caught before they ship, including the risks in your dependencies.
What we test
- Authentication, payments and data-handling code
- Dependency and supply-chain checks
- Static and dynamic analysis in your CI/CD
- Exposed secrets detection
- You receive
- Findings by file and line, with fixes and pipeline changes your team can merge.
- Based on
- OWASP ASVS · OWASP Top 10 A03
Security talent for your team
Application security, cloud and DevSecOps profiles
Add the specialists you need to your squad, by search or by staffing, and keep the capability after the assessment ends.
What we test
- Application security engineers
- Cloud security engineers
- DevSecOps engineers
- Search or dedicated staffing
- You receive
- A validated shortlist, or dedicated engineers integrated into your team.
- Based on
- OpenLab technical validation
The OWASP Top 10, covered
The ten most critical web application risks, and what each one means for your product.
- A01
Broken Access Control
Users reaching data or actions beyond their permissions.
- A02
Security Misconfiguration
Insecure defaults, exposed services and missing hardening.
- A03
Software Supply Chain Failures
Compromised or vulnerable dependencies, build processes or software distribution.
- A04
Cryptographic Failures
Weak or missing encryption of data in transit and at rest, and poor key management.
- A05
Injection
Untrusted data interpreted as commands: SQL, operating system, XSS and similar.
- A06
Insecure Design
Security controls that are missing or ineffective by design.
- A07
Authentication Failures
Weak login, credential and session handling.
- A08
Software or Data Integrity Failures
Code and data trusted without verifying their integrity.
- A09
Security Logging and Alerting Failures
Missing logs and alerts that prevent detecting and responding to attacks.
- A10
Mishandling of Exceptional Conditions
Errors and abnormal conditions handled badly, causing failures or exposure.
How an assessment works
Five steps from authorization to verified fixes. Duration depends on scope and is estimated in the proposal.
Scope and authorization
We agree on targets, rules of engagement and a written authorization. NDA before kickoff.
Reconnaissance and threat model
We map your attack surface and decide what an attacker would go after first.
Testing
Manual testing backed by tooling, with evidence for every finding.
Reporting
An executive summary and technical findings with severity, evidence and remediation steps.
Fix support and retest
We walk your developers through the findings and verify the fixes.
A report your team can act on
No scanner dumps. Every finding is validated and explained.
- Executive summary for leadership
- Technical detail with evidence and steps to reproduce
- Severity rating (CVSS) and business impact
- Prioritized remediation guidance
- Retest to confirm the fix
Broken object-level authorization in an invoices API
A01 Broken Access Control
- Evidence
- Changing the invoice ID in the request returns another customer's invoice.
- Recommended fix
- Verify on the server that the invoice belongs to the authenticated user, on every request.
Three ways to work with us
People
We add application, cloud and DevSecOps profiles to your team, by search or by staffing.
Product
Access control, encryption and architecture review are part of the design, not a later patch.
Continuity
Your team keeps clear criteria to sustain security after delivery.
Ideal ifyou are going to grow, integrate new talent or launch a product that handles customer data.
Frequently asked questions
A scan runs automated checks and lists possible issues. A penetration test adds manual testing to confirm what an attacker can actually exploit. An attack simulation goes further and chains techniques across systems to test how your team detects and responds.
We agree the scope, the testing windows and the systems to exclude before starting, and we avoid disruptive techniques unless you approve them in the rules of engagement.
The scope (applications, APIs or cloud accounts), test accounts when relevant, a technical contact and a signed authorization.
Yes. Once your team fixes the findings, we verify them and update the report.
It depends on scope: the number of applications, endpoints and roles. We estimate it in the proposal, after a short conversation to define the scope.
Tell us what you need to protect
A short conversation is enough to define the scope and send you a proposal.
Tell us what you need to protect
With this we define the scope of the assessment.
Prefer a direct channel?