Penetration testing in São Paulo for businesses
Penetration testing and offensive security for companies in the city of São Paulo and Greater São Paulo. Based in Sorocaba, SP, we run projects remotely, with the same scope, methodology and reports we deliver across Brazil.
- Authorized scopescopeTargets, windows, test accounts and limits, approved before the first test
- Findings with evidenceevidenceRequests, responses and reproduction steps for each flaw
- Priority by riskriskJustified severity and order of remediation
- RetestretestConfirmation of the fixes, when included in the contracted scope
A pentest does not guarantee compliance on its own; the report is one piece of technical evidence among others.
Penetration testing services for companies in São Paulo
The same services we offer across Brazil, with the scope tailored to each company's environment.
Web Application Pentest
Security assessment of web applications focused on authentication, authorization, the OWASP Top 10 and business logic flaws.
API Pentest
Analysis of REST and GraphQL APIs for authentication and authorization flaws, data exposure and endpoint abuse.
Infrastructure Pentest
Assessment of networks, servers and cloud environments focused on exposure, segmentation and critical vulnerabilities.
Code Review
Security-focused code review covering flawed validation, authentication and insecure development patterns.
Threat Modeling
Identification of attack surfaces, threats and risks in critical architectures and systems.
Cybersecurity Consulting
Risk analysis, LGPD compliance support and technical guidance to prioritize security investments.
For corporate environments in São Paulo
Companies with many systems, teams and audit requirements need a pentest that is documented, authorized and easy to evidence.
What the project includes
- Formally authorized scope, with defined targets, windows and limits
- An executive report for leadership and a technical report with evidence
- Reproduction steps and risk-prioritized recommendations
- Material usable as technical evidence in audits (ISO 27001, SOX, NIST, PCI-DSS)
- Support for LGPD compliance
- Retest of fixes, when included in the contracted scope
Sectors with frequent security requirements
- Banks and Fintechs
- Insurers
- E-commerce
- Healthcare
- Telecommunications
- Energy and Utilities
- Technology and Software
A clear process, from scope to report
You know what will be tested, when, and within which limits before the first test runs.
- 01
Discovery and scope
We discuss the environment, the goals and the critical assets to define what will be tested.
- 02
Planning and authorization
Targets, windows, test accounts and limits are documented and authorized before any testing starts.
- 03
Execution and validation
Manual testing supported by tools, with controlled exploitation to confirm real impact.
- 04
Report and guidance
We deliver the reports, walk you through the results and guide the remediation.
Frequently asked questions — pentest in São Paulo
How much does a penetration test cost for a company in São Paulo?
The price is set after an initial scoping and depends on how many systems, APIs and environments are assessed, as well as audit requirements such as ISO 27001, SOX or PCI-DSS.
Do you serve companies throughout Greater São Paulo?
Yes. We work remotely from Sorocaba-SP with companies in the city of São Paulo, Greater São Paulo, the ABC region and the wider metropolitan area. Scoping and results meetings are held online.
Can the pentest report be used as evidence for ISO 27001 and SOX?
A pentest does not guarantee compliance on its own, but the report documents scope, methodology, findings and evidence, and can be used as technical evidence in ISO 27001, SOX and NIST audits, as well as supporting LGPD compliance.
Do you offer anything beyond a one-off pentest?
Work is organized as projects with a defined scope: pentests, code review, design review, threat modeling and security consulting. A retest of the fixes can be part of the contracted scope, and new assessments can be planned as the environment evolves.
How long does a pentest take for a large company?
It depends on the size and complexity of the scope. The timeline is estimated in the proposal, before you sign.
Do you work with multinationals headquartered in São Paulo?
Testing follows internationally recognized methodology references such as OWASP and PTES, and the scope takes into account the company's corporate requirements and the LGPD. The format of the deliverables is agreed in the proposal.
Strengthen your company in São Paulo
Describe the environment and the goal of the test. We reply with scoping questions, followed by a proposal.
Sending this form neither starts any testing nor authorizes it: testing begins only after the scope is defined and authorized in writing.
- [email protected]
- Phone
- +55 (15) 99745-2589
- Chat on WhatsApp
- Hours
- Monday to Friday, 9am to 6pm
- Confidentiality
- NDA before any sensitive information