Exposure Management

If an attacker decided to compromise your company today, would they succeed?

Passing compliance does not mean real resistance. SEK replicates the tactics of threat groups active in Latin America. Penetration testing, red teaming and adversary simulation with over 25 years of offensive operation and in-house tooling, to answer that question with evidence.

Request a test scope Book an FRA session

Already know you are looking for an annual programme? Go straight to Business Takeover Simulation ↓

+800Organisations assessed in the region

+50Offensive specialists

+450Researchers in the CyScope community

+25Years of offensive operation

The surface

See everything that is exposed. Prove what is exploitable.

Four layers of the attack surface, swept continuously, from what sits outside the inventory to the internal environment. You can only validate what you can see.

Continuous visibility5 verticals

EASM

External attack surface · outside the inventory

What is on the internet in the company's name, seen through the attacker's eyes.

External vuln

External vulnerability management · external perimeter

The blind spot the attacker sees first.

CSPM

Cloud posture · cloud

Configuration, legacy and excessive permissions in the cloud.

Internal vuln

Internal vulnerability management · internal environment

Internal perimeter prioritised by business context.

CTEM

Continuous technical compliance · see Governance ↓

Configuration measured against the CIS Benchmark permanently. It answers "am I compliant?", not "what do I have exposed?".

The first four verticals are contracted as a continuous programme in the Continuous exposure family. The fifth lives in Governance.

Catalogue · 5 families

Five families, from continuous exposure to the persistent adversary

Organised by what is tested, not by the tool that tests. Each service states its depth: one-off, recurring or programme.

01Adversary simulationWould they detect us, and would we respond?4 services · a ladder up to the annual programme

Table TopOne-offTable Top ExerciseA rehearsal of decision-making under crisis, with no technical execution. Technical, executive or mixed profiles facing a real scenario from their industry.

Red TeamOne-offRed Team ExerciseA targeted, confidential attack across digital, social and physical vectors, validating the defence team's real detection.

PurpleRecurringPurple TeamMITRE ATT&CK with a blind phase that measures real MTTD, MTTC and MTTR, and a coordinated phase that tunes SIEM, EDR and firewall in real time.

TAEQuarterlyThreat Actor EmulationQuarterly cycles emulating the tactics of groups active in the region: ransomware, state-sponsored APT and financially motivated groups.

The ladder: Table Top rehearses the decision. Red Team validates it once. TAE sustains the quarterly rhythm. Business Takeover Simulation ↓ turns that capability into an annual programme of four cycles.

02Human riskDo my people resist, and do they know how to react?13 services · we test, we strengthen, we test again

We test human resilienceDigital channels · 5

Each campaign measures individual behaviour, not the effectiveness of the email filter.

PhishingRecurringPhishingTargeted email with individual tracking and a trail by department.A one-off campaign, or part of the continuous programme ↓

SMiShingRecurringSMiShingSMS and messaging vector, where the corporate filter does not reach.

QRshingOne-offQRshingMalicious QR codes in physical and digital spaces.

DeepfakeOne-offDeepfakeVoice and image forgery of executives to validate authorisation controls.

BiometricOne-offBiometric PentestPresentation attacks against biometric authentication controls.

We test physical accessOn-site perimeter · 1

The on-site perimeter is as critical as the digital one, and it is almost never tested.

PhysicalOne-offPhysical intrusionTailgating, credential cloning, device drops and access to the data centre and restricted areas.Also as a vector inside a full red team ↑

On-site interventions3

People remember what they live through. Formats that install the habit, rather than tick a training box.

TalkOne-offTalkA session with real cases from the client's industry, on site or remote.

ActivationOne-offActivationA high-impact intervention in the workplace, at the moment the behaviour happens.

ExperimentOne-offSocial ExperimentA behaviour test in real conditions, with recorded evidence to show the team.

Content and experiences3

AudiovisualOne-offAudiovisual contentPieces produced in the client's own identity and language.

GamesRecurringOnline gamesLearning dynamics with participation metrics.

CyberBoxOne-offCyberBoxA packaged awareness experience, ready to deploy.

The full cycle1

ProgrammeRecurringAwareness programmeCampaigns designed by our team around each organisation's context and language, not catalogue templates. Run on a specialised platform, with reporting that is comparable across cycles.

03Technical assessmentIs it exploitable?8 services · scope defined by the business process

Infrastructure2

InternalOne-offInternal penetration testingActive Directory, lateral movement and Kerberoasting, prioritised by real impact and not only by CVSS.

ExternalOne-offExternal penetration testingPublished perimeter, exposed services and initial-access chains.

Applications and APIs2

Web / APIOne-offWeb and API penetration testingOWASP Top 10 and, above all, business-logic flaws that no tool identifies.

MobileOne-offMobile penetration testingAndroid and iOS: local storage, channel, anti-tampering controls and backend.

Networks and remote access2

WirelessOne-offWireless networksCorporate Wi-Fi, guest segmentation and authentication controls.

AccessOne-offRemote Access Security AuditVPN, remote desktop and third-party access: the door left open after remote work.

Cloud and third parties2

CloudOne-offCloud penetration testingExploitation of identities, excessive permissions and configuration in cloud environments.

Third partiesRecurringSupplier assessmentTechnical validation of the posture of third parties with access to your environment.

04Critical surfacesAnd what cannot stop?3 services · specialised buyer, current alliances and certifications

Three surfaces where the mistake is not measured in leaked data, but in stopped production, money moved or an automated decision nobody reviewed.

OT / ICSOne-offOT and ICS penetration testingPLC, RTU, HMI and SCADA with an OT-safe methodology, without interrupting the industrial process. A dual report, for engineering and for the CISO.

FinancialOne-offFinancial ethical hackingPOS, ATM, SWIFT, instant payments and digital wallets. Firmware, transaction logic and PCI DSS compliance.

AIOne-offPenetration testing of AI agents and modelsPrompt injection, model extraction, context poisoning and abuse of the tools the agent is allowed to use.Complements AI Resilience →

05Continuous exposureWhat do I have exposed, all the time?8 services · a subscription, not a project

Discovery and monitoring5

EASMProgrammeExternal attack surfaceWhat is on the internet in the company's name, seen through the attacker's eyes.

External vulnProgrammeExternal vulnerability managementThe blind spot the attacker sees first.

Internal vulnProgrammeInternal vulnerability managementInternal perimeter prioritised by business context.

CSPMProgrammeCloud postureConfiguration, legacy and excessive permissions in the cloud.

Shadow AIProgrammeShadow AI discoveryAI models, agents and services in use that never went through an inventory or a security review.

Continuous validation3

PTaaSProgrammePentest as a ServiceContinuous penetration testing over in-scope assets, with findings delivered as they appear.

Bug BountyProgrammeBug BountyA managed programme with the CyScope community, with a disclosure policy and rewards.

DRSRecurringDigital Risk SurfaceOSINT on exposed subdomains, leaked credentials and impersonation attempts.

An accessible entry point: Digital Risk Surface and web penetration testing validate the initial posture without the scope of a full programme. A smaller ticket, high discovery value, and usually the first step towards something broader.

The programme

One year. Four cycles. An adversary that does not go away.

Business Takeover Simulation

Red Team · one-offTAE · quarterlyBTS · annual

Governance

From technical finding to governance decision

A technical report answers what happened. It almost never answers why it existed, who owns the fix or how you verify that it does not come back. That translation is a distinct piece of work, and it is where a finding stops being a ticket and becomes a decision.

01The technical data

Finding, evidence and real exploitability. The starting point, not the conclusion.

02The cause in the process

Why it was possible: which control was missing, which decision enabled it, what repeats elsewhere for the same reason.

03Owner, control and metric

Who owns it, which control closes it and how it is verified. With no owner, the fix depends on somebody remembering.

04Board and regulator language

The same finding expressed as business risk and as evidence of compliance.

When the goal is that the finding does not come back the following year, our governance team takes the technical data through to root cause, owner and control, using regulation as the common language. Compliance is not the destination: it is how improvement becomes verifiable by a third party.

The instruments

International standards

ISO 27001 ISMS implementationFrom diagnosis to certification.
NIST CSF 2.0 assessmentMaturity by function and an action plan.
CIS Controls v8 assessmentCoverage by implementation group.
SWIFT CSPThe customer's annual attestation.
Continuous technical complianceConfiguration measured against the CIS Benchmark permanently.

Local regulation by country

LGPD and ANPDBrazil.
BCB resolution and central-bank requirementsBrazil · financial institutions.
Personal Data Act 21.719Chile.
RAN 20-10 CMFChile · banking and financial institutions.
Financial and data regulationPeru, Colombia and Argentina.

Governance and leadership

Strategic advisory and cybersecurity governanceStructure, committees, policies and board metrics.
CISO as a ServiceDedicated security leadership, on a fractional basis.
Maturity assessment and multi-year planA baseline, prioritised gaps and the associated budget.

Resilience programmeResilience Acceleration Program

Where BTS answers "would we resist an attack?", RAP answers "how long would it take us to get back to operating?". A bounded intervention with a baseline, quarterly targets and executive follow-up, to move resilience from one point to another within a defined period. It lives inside the SEK method.

See the RAP method

Why SEK

Offensive operation, not catalogue penetration testing

Catalogue pentest

SEK operation

Who executes

A consultant running somebody else's tool

A team that researches and speaks at Ekoparty, 8.8 and DEF CON

Tooling

A public framework, the same for every client

In-house methodology and tooling, with offensive AI

Scope

Whatever the tool can scan

The business process that cannot fail

Execution

Automated, finds the obvious

Over 80% manual, chaining smaller flaws

Coverage

Digital perimeter

IT, OT, AI, human and physical

Deliverable

A list of CVEs

A narrative and evidence the CISO takes to the board

Next step

Two ways in

If you already know what you want to test, ask for the scope directly. If you do not know where to start, run the diagnostic first and prioritise by risk.

Request a test scope