We simulate real attacks with the techniques criminals use, under authorization and with a clear method. Before setting the scope we find out why you need the test, because that changes the approach, the depth and the report.
Attacks happen every day. Companies that don't test their own security usually find the gaps the hard way: after an incident.
A pentest for a PCI DSS audit, for the Brazilian Central Bank (BCB), for a customer or to measure your own defenses are different jobs. That's why the first conversation is about why, and only then about scope.
Measures external exposure and detection capability. Makes sense once the company has an asset inventory, monitoring and basic controls.
Covers more surface in the same time and finds authorization flaws a blind test can't reach. The most common starting point.
Gives the greatest depth. Suited to products, launches and critical systems built in house.
When basic controls are missing, a black box test burns much of its hours finding out what your team could have told us in one meeting. And proposals that combine black box testing with interviews, an assessment and a standards audit give the tester exactly the information the test assumes they don't have. In these cases we say so before the proposal and recommend what will produce results, such as an assessment followed by a gray box test.
Structured and transparent process. You track every step in real time.
The same test produces different documents for the board, the tech team and whoever asks for the evidence, be it an auditor, a regulator or a customer.
Within 24h we'll set up a call to understand the goal of the test. The proposal follows, with the right approach for it.
Figures without a listed source, such as environments tested, certifications delivered, satisfaction and case results, come from IONICZ projects. Links checked in October 2026.