Independent cybersecurity consulting

Is your environment
really
secure?

First we understand where your company stands and what it needs to achieve. Then we recommend what will actually solve it, with no packaged offers and no vendor ties. OSCP, CISSP, CEH and ISO 27001 certified team.

Free Assessment Our Services
500+
Protected companies
24/7
Support available
98%
Satisfaction rate
24+
Years in market
ionicz@redteam ~ scan
$ ionicz-scan --target client --full Starting reconnaissance... Mapping attack surface...   [ FINDINGS ]   ● CRITICAL SQL Injection in /api/users ● CRITICAL Auth Bypass via JWT ● HIGH XSS Stored in /comments ● HIGH IDOR in /api/orders/:id ● MEDIUM Missing HSTS headers   ✓ Report generated · CVSS 9.8 / 8.1   $
Certifications
OSCPCISSPCISM CEHISO 27001OWASP NIST CSFMITRE ATT&CKPCI-DSSLGPD
About IONICZ

Tailored security
for your business

IONICZ is an independent information security consultancy with a certified technical team, working in Brazil, the United States and Latin America. We don't resell tools and we have no commercial partnerships with vendors.

Every engagement starts with a conversation about where the company is and what the work needs to achieve. That tells us the right mix of offensive security and risk management, from a technical pentest to executive governance as your vCISO.

  • Certified team: OSCP, CISSP, CISM, CEH, ISO 27001 Lead Auditor
  • Methodologies: OWASP, PTES, NIST CSF, MITRE ATT&CK
  • Reports written for whoever will use them: regulator, auditor, customer, board or tech team
  • Independent recommendations, with no product sales targets
  • 24/7 support for critical incidents
500+
Protected companies
24+
Years in market
23+
Critical vulns / project
98%
Client satisfaction
How we work

Your goal first.
Then the recommendation.

Every conversation with IONICZ starts with context: what prompted the call, what has to be solved and who the deliverable is for. Only then do we recommend the service, the depth and the format of the result.

Legal or regulatory obligation
Brazilian Central Bank (BCB), LGPD, ANEEL, Anatel. The scope follows the text of the rule and the report is written in the format the supervisor will review.
Certification
ISO 27001, PCI DSS, SOC 2, TISAX. The work targets what the auditor will check and produces the evidence they ask for.
Customer or contract requirement
A security questionnaire, due diligence or a contract clause. The deliverable answers what your customer actually asked.
Investing in maturity
With no external deadline, the priority is to cut the biggest risk first and show progress to the board.
Incident or suspicion
First contain and understand what happened. Then fix the root cause so it doesn't happen again.
In practice
When the request doesn't fit the moment, we say so

We often get requests for black box pentests from companies that don't yet have an asset inventory or basic controls. A blind test then spends much of its hours discovering what the team could have explained in a single meeting, and the report confirms problems everyone already knew about.

We also see proposals that bundle a black box test, an assessment and an ISO 27001 audit into one package. The tester gets documentation and interviews, so the test is no longer blind. In those cases we explain the difference and recommend what will deliver results now, such as a maturity assessment followed by a gray box pentest.

Independence
  • No vendor tiesWe don't resell tools, licenses or platforms. No recommendation depends on a commission or a partner's sales target.
  • We start from what you already haveWe work with your existing tools and team. When something new is needed, we present options from more than one vendor and the criteria behind the choice.
  • A proposal sized to the goalNo fixed packages. The scope covers what the goal requires and states clearly what was left out and why.
Talk to us about your situation
What we do

Our Services

Each service is sized after the discovery call. The proposal covers what your goal requires, with no fixed packages.

01
Pentest
Penetration tests on web, mobile, API, network, cloud and OT, with a black, gray or white box approach chosen by the goal of the test.
OWASPPTESCVSSRed Team
02
Product Analysis
Security review of code and applications before launch or a customer's due diligence, combining manual analysis and tools.
Code ReviewSASTDAST
03
vCISO
Senior security leadership, part time, with an agenda set by where the company is: regulator, certification, customers or building the function.
ISO 27001LGPDNIST
04
Vulnerability Management
Continuous discovery, prioritization by business impact and follow-up until the fix, using the tools you already have.
24/7SIEMThreat Intel
05
Security Awareness
Awareness training and phishing simulations designed for the risk profile of each team, with metrics for the board.
Phishing SimGamificationKPIs
06
Compliance & Audit
ISO 27001, PCI DSS, SOC 2, LGPD and BCB rules, scoped to what the auditor or regulator will actually check.
ISO 27001PCI-DSSLGPD
Scope of work

Test any
cyber structure

We run offensive tests on modern, critical and legacy environments. The approach (black box, gray box or white box) depends on the goal of the test and the maturity of the environment.

Web Applications
Portals, SaaS, e-commerce
Most common
APIs
REST, GraphQL, SOAP
Mobile Apps
Android, iOS, hybrid
Cloud
AWS, Azure, GCP
Network / Infra
External, internal, segmentation
Social Engineering
Phishing, vishing, pretexting
IoT & OT
SCADA, devices, industrial
Source Code
SAST, security review
    Methodologies:
    Request Pentest
    Real results

    Success Cases

    Companies from different sectors that strengthened their security posture with IONICZ.

    Financial
    Full Pentest
    Financial Institution
    PCI-DSS compliance and data protection for 2M+ clients in a critical environment with multiple integrations.
    • 19 critical vulnerabilities identified
    • 100% PCI-DSS compliance achieved
    • Zero incidents in the following 18 months
    E-commerce
    Awareness
    National Retailer
    High phishing rate and compromised credentials across a distributed team of 800 employees.
    • 92% reduction in phishing clicks
    • 85% training engagement
    • Security culture established
    Health Tech
    vCISO + ISO 27001
    Telemedicine Startup
    LGPD and ISO 27001 compliance for international expansion with sensitive patient data.
    • ISO 27001 certification in 8 months
    • 100% LGPD compliance
    • 65% cheaper than a dedicated CISO

    "IONICZ found vulnerabilities that other consultancies missed. Clear report, agile support and genuine commitment to results. We recommend without hesitation."

    Director of Technology · Financial Institution
    Why IONICZ

    What sets us apart

    International Certifications
    OSCP, CISSP, CISM, CEH and ISO 27001 Lead Auditor, the most respected certifications in the field.
    Global Operations
    Projects in Brazil, USA and Latin America with command of the local and international threat landscape.
    Transparent recommendations
    If the service you asked for won't solve the problem, we explain why and suggest the alternative before sending a proposal.
    24/7 Support
    Priority support for critical incidents. Available when you need it most.
    Deliverables for whoever uses them
    Reports in the format the regulator, the auditor, your customer, the board or the tech team need to read.
    Independent from vendors
    No resale, commissions or targets with technology vendors. The recommendation depends only on your problem.
    FAQ

    Frequently Asked Questions

    Yes, and we still start with a short conversation about the goal. If the service you asked for is the right one, the proposal comes back exactly as requested. If it isn't, we explain why and show you the alternative. The decision stays with you.
    No. We have no resale agreements, commissions or targets with any technology vendor. We use the right tools for each job, preferably the ones your company already has, and when something new is needed we present options from more than one vendor along with the criteria for choosing.
    Both the scope and the deliverable change. For regulatory requirements such as CMN Resolution 4,893, the work follows the text of the rule and the reports are built for the supervisor, linking each requirement to the test performed and the evidence. A pentest for a regulator, for a customer or for the tech team does not produce the same document.
    No. They block what is already known. According to Verizon, exploiting vulnerabilities is now the most common way into a breach (31% of cases), and the human element is present in 62% of them. A pentest finds those gaps before a criminal does.
    High. According to IBM, the global average cost of a data breach reached USD 4.99 million in 2026, a record high, adding up downtime, regulatory fines and lost customers.
    Yes, and the liability is yours. Brazil's LGPD allows fines of up to 2% of revenue in Brazil, capped at BRL 50 million per violation, and the EU's GDPR goes up to 4% of global annual turnover. Documented security testing works in your favor with regulators and courts.
    It drops, and it doesn't always come back. Customers start to wonder whether their data is safe with you. Reputation takes years to build and one incident to damage.
    Remotely, with secure and encrypted workflows. We have active engagements in Brazil, the United States and Latin America, with reports in English and a point of contact available in your time zone.
    Knowledge

    Blog & Threat Intel

    Analysis, trends and news from the cybersecurity world.

    TrendsNov 15, 2025
    Generative AI and Cybersecurity: Opportunities and Risks in 2025
    How AI changed both defense and attack, and what your company needs to know.
    Read article
    ComplianceNov 8, 2025
    LGPD: 5 Common Mistakes That Could Cost Millions
    Main compliance failures and how to fix them before a regulatory audit.
    Read article
    RansomwareNov 1, 2025
    Ransomware 2025: Tactics, Techniques and Defense Strategies
    Updated overview of major ransomware families and best mitigation practices.
    Read article
    Let's talk

    Tell us where you are.
    We'll point the way.

    Within 24h we'll schedule a free discovery call to understand your goal, timeline and context. The recommendation comes after that.

    WhatsApp
    (11) 94791-9311
    Emergency support
    24/7 for critical incidents
    Coverage
    Brazil · USA · Latin America

    Your details are used only to reply to you. They are never sold or used for marketing. We keep them for 12 months (24 if you request a proposal), and you can ask us to delete them at any time at [email protected].

    ✓ Free assessment · Response within 24h
    Sources and references

    Figures without a listed source, such as environments tested, certifications delivered, satisfaction and case results, come from IONICZ projects. Links checked in October 2026.