toukan.dev

product

Pentest Guatemala

Cybersecurity and pentesting in GuatemalaCybersecurity and pentesting in Guatemala

What it is

A system has doors. The internet, a remote vendor, a shared account, a privilege nobody revoked.

Pentesting is walking those doors with a signature, then writing down what could be done and how it closes.

The chain

  1. 01System

    What is running. It has a name.

  2. 02Surface

    How you reach it. Internet, vendor, account, privilege.

  3. 03Signature

    Who authorizes the touch. No signature, no test.

  4. 04Path

    A real path is walked. A port is not a list.

  5. 05Finding

    What could be done with that.

  6. 06Report

    System, finding, fix. For the person who has to defend it.

If a link is missing, there is no test. There is a document.

A reading first

Before you request scope. Nothing is sent. It shows what you can already stand behind.

Can you name the systems that would be in scope?
Is there one person who can sign that they may be touched?
Do you know how those systems are reached?

Internet, VPN, remote vendor, shared accounts, privilege.

Does the last report name what was in and what was out?
If a finding appears, who changes the system?
For you
You. The person comparing cybersecurity firms in Guatemala who has to defend a report in front of a committee. A bank, group, or operator.
Your problem
ISO 27001 and PCI DSS are already the committee's words. You still need a scoped test and a report someone who is not a pentester can read.JM-98-2025, Art. 18, requires internal and external penetration tests at least yearly, with results in a technical report. It replaced JM-104-2021 and its adaptation deadlines are running.
The product
An authorized test. A report written in the words the committee already uses: pentesting, ISO 27001, PCI DSS.Internal and external pentest with a technical report, as JM-98-2025 Art. 18 requires. Written scope, findings with fixes, ready for the Security Officer and internal audit.

You receive

Scope
Named systems. Named owner. What is in and what is out, in writing, before anyone touches anything.
Authorization
Signature first. No signature, no test. You decide when it starts.
Test
Real paths: privileged access, internet exposure, shared accounts, vendor remote access.
Report
System, finding, what can be done with it, how to close it. Written for the person who has to defend it.

How it runs

  1. 01You write the institution, the systems, and what the evidence is for.
  2. 02We agree scope and authorization. If it does not fit, we say so.
  3. 03We run the test in a closed window.
  4. 04We deliver the report. Each finding has a fix your team can make.

This is not

  • A dashboard.
  • An unauthorized scan to "show value".
  • The ISO 27001 or PCI DSS certificate. The certifier signs that.
  • A transformation program. This is a product: a test and a report.
  • A bench of 200 engineers. This is not nearshore.
  • A ranking of cybersecurity firms. They buy a scope, not a list.

Start

Write the institution, systems in scope, and whether this is for a committee, ISO 27001, or PCI DSS.

[ Request scope ][ Book 30 min: gaps against JM-98-2025 ][email protected]