toukan.dev

product

Pentest Costa Rica

Cybersecurity and pentesting in Costa Rica

What it is

A system has doors. The internet, a remote vendor, a shared account, a privilege nobody revoked.

Pentesting is walking those doors with a signature, then writing down what could be done and how it closes.

The chain

  1. 01System

    What is running. It has a name.

  2. 02Surface

    How you reach it. Internet, vendor, account, privilege.

  3. 03Signature

    Who authorizes the touch. No signature, no test.

  4. 04Path

    A real path is walked. A port is not a list.

  5. 05Finding

    What could be done with that.

  6. 06Report

    System, finding, fix. For the person who has to defend it.

If a link is missing, there is no test. There is a document.

A reading first

Before you request scope. Nothing is sent. It shows what you can already stand behind.

Can you name the systems that would be in scope?
Is there one person who can sign that they may be touched?
Do you know how those systems are reached?

Internet, VPN, remote vendor, shared accounts, privilege.

Does the last report name what was in and what was out?
If a finding appears, who changes the system?
For you
You. You work in a bank or regulated operator and have to deliver ISO 27001 or PCI DSS evidence. You do not need a critical-infrastructure page. You need a scoped test.
Your problem
The regulated operator buys evidence. The last test had no real scope. The committee wants a report you can stand behind.
The product
An authorized test. A report for ISO 27001 and PCI DSS. The same product as the rest of the region, in the words you already search.

You receive

Scope
Named systems. Named owner. What is in and what is out, in writing, before anyone touches anything.
Authorization
Signature first. No signature, no test. You decide when it starts.
Test
Real paths: privileged access, internet exposure, shared accounts, vendor remote access.
Report
System, finding, what can be done with it, how to close it. Written for the person who has to defend it.

How it runs

  1. 01You write the institution, the systems, and what the evidence is for.
  2. 02We agree scope and authorization. If it does not fit, we say so.
  3. 03We run the test in a closed window.
  4. 04We deliver the report. Each finding has a fix your team can make.

This is not

  • A dashboard.
  • An unauthorized scan to "show value".
  • The ISO 27001 or PCI DSS certificate. The certifier signs that.
  • A transformation program. This is a product: a test and a report.
  • A bench of 200 engineers. This is not nearshore.
  • A university degree. This is a test, not a title.

Start

Write the institution, systems in scope, and whether this is for a committee, ISO 27001, or PCI DSS.

[ Request scope ][email protected]