Companies that trust BrownPipe
Offensive Security
Identify vulnerabilities in your network with service tiers that match your needs and budget.
No commitment. We reply within one business day.
Companies that trust BrownPipe
For your organization
Your network is the foundation of every operation. Servers, services, integrations, and access controls must be protected against constantly evolving threats.
An infrastructure pentest reveals where your environment is exposed and what needs to be fixed. Organizations seek this service when they need to:
Discover exposures before an attacker does
Meet compliance requirements (PCI-DSS, ISO 27001, SOC 2, GDPR)
Validate security after network changes or cloud migrations
Test whether network segmentation actually works
Assess the security of cloud environments (AWS, Azure, GCP)
Provide evidence of due diligence to clients, partners, or insurers
Service Tiers
We offer three infrastructure assessment tiers. The choice depends on your objective, budget, and the depth of analysis your organization requires.
Automated assessment using industry-leading scanning tools. We run the scan against your environment and deliver the raw output generated by the tool, without filtering or additional analysis.
Organizations that need quick visibility into their environment, have an internal technical team to interpret raw results, or want a first diagnostic at a lower investment.
Fixed fee for running the scan, plus a charge for each severity-level report included. You decide what you want to receive.
Important: Results are delivered as-is from the tool, without manual validation. This means they may contain false positives and information that requires technical interpretation.
The same automated scan as the previous tier, but with a layer of human review. A BrownPipe specialist analyzes the results, removes noise and false positives, and delivers a report that makes sense for your context.
Organizations that need an actionable report without spending time filtering hundreds of irrelevant alerts. Ideal for those who want environment visibility with analytical quality but do not yet require manual exploitation.
Scanning fee plus a charge for the expert analysis.
You get more accurate reports, reviewed by the BrownPipe team.
A comprehensive penetration test, conducted manually by the BrownPipe technical team. We identify vulnerabilities, exploit them in a controlled manner, verify lateral movement, and document exactly how exposed your environment is.
Organizations that need to know the real risk, not just a list of CVEs. Companies that require concrete proof of impact, want to test the effectiveness of security controls, or need to meet compliance requirements that demand pentesting (PCI-DSS, audits, client contracts).
Base price that includes a set number of hosts. Additional hosts are charged based on complexity level.
You do not just receive a report. You have a team of specialists by your side from start to finish, through to the validation that the issues have been resolved.
Full pentest
We start by defining the scope together with you: which networks, hosts, and services will be assessed, testing windows, emergency contacts, and rules of engagement.
Vulnerability identification combines automated scanning with manual analysis. We do not limit ourselves to what the tool reports: we investigate configurations, permissions, integrations, and behaviors that may pose a risk.
When we gain initial access, we verify expansion possibilities: escalate privileges, access other systems, and reach critical assets. The entire process is documented with evidence: screenshots, executed commands, and proofs of concept.
Request a proposalWe define together with you which networks, hosts, and services will be assessed, testing windows, emergency contacts, and rules of engagement.
Our team maps the environment's attack surface, identifying hosts, services, versions, and exposed configurations.
We combine automated scanning with manual analysis. We do not limit ourselves to what the tool reports: we investigate configurations, permissions, integrations, and behaviors that may pose a risk.
Each relevant vulnerability is verified and exploited in a controlled manner to validate whether it is actually exploitable and what its impact is in your context.
When we gain initial access, we verify expansion possibilities: escalate privileges, access other systems, and reach critical assets.
The entire process is recorded with evidence: screenshots, executed commands, proofs of concept. You see exactly what we did and what we achieved.
We deliver a complete technical report with vulnerabilities, contextualized severity ratings, and prioritized remediation recommendations.
We remain available to answer questions during remediation.
After you fix the critical and high vulnerabilities, we retest to validate that the corrections were effective.
Standards
Our tests follow internationally recognized methodologies, adapted to the reality of each environment.
The choice and combination of methodologies depends on the scope and objectives of the project. This ensures the test meets compliance requirements (PCI-DSS, ISO 27001, audits) while remaining relevant to your organization's specific context.
NIST SP 800-115
NIST technical guide for security testing of networks and systems
OSSTMM
Methodology focused on metrics and attack surface coverage
PTES
Standard that defines phases and deliverables for professional penetration testing
MITRE ATT&CK
Framework for mapping lateral movement and privilege escalation techniques in the environment
Comparison
| Scanning | Scan + Analysis | Full Pentest | |
|---|---|---|---|
| Automated execution | |||
| Expert analysis | - | ||
| False positive removal | - | ||
| Manual exploitation | - | - | |
| Proof of real impact | - | - | |
| Lateral movement | - | - | |
| Detailed technical report | Basic | Contextualized | Comprehensive |
| Remediation recommendations | Generic | Adjusted | Prioritized |
| Post-delivery support | - | - | |
| Retest after remediation | - | - |
Common questions
It is a penetration test that assesses an organization's networks, servers, devices, and services, both internet-facing and internal. Unlike an automated scan that only lists known CVEs, a pentest involves manual exploitation of vulnerabilities, real impact validation, and demonstration of complete attack paths. The result is a technical report showing exactly what an attacker could achieve in your environment, with evidence, risk classification, and clear remediation guidance.
An automated scan lists known vulnerabilities using signatures. It delivers fast results but generates false positives and does not validate whether the flaws are actually exploitable. A pentest uses the scan as a starting point, but the work is manual: exploiting flaws, chaining attacks, and demonstrating what an attacker could actually achieve.
If you need quick visibility and have a technical team to interpret raw results, the Scanning tier fits. If you want a clean and actionable report, choose Scanning with Analysis. If you need to know the real risk, with exploitation and support through remediation, the Full Pentest is the right choice.
Scanning: 1 to 3 business days. Scanning with Analysis: 3 to 7 business days. Full Pentest: on average 45 days, depending on scope and complexity, with shorter timelines possible according to the client's needs.
We follow a controlled methodology. Denial-of-service (DoS) tests and potentially destructive exploits are only executed with explicit authorization and during agreed-upon windows. Most tests do not impact production.
Yes. We assess security configurations, IAM, storage, virtual networks, and integration with on-premises environments. The scope is defined in advance, respecting each provider's terms of use.
Yes. PCI-DSS Requirement 11.3 mandates annual pentesting and testing after significant changes. Our tests follow methodologies accepted by the standard (NIST SP 800-115, OSSTMM, PTES), and the reports meet the documentation requirements demanded by auditors.
After you remediate the vulnerabilities, we retest the critical and high findings to validate that the fixes were effective, at no additional cost. The deadline to request the retest is defined in the proposal.
We notify you immediately so that emergency measures can be taken. We do not wait for the final report to alert you about serious risks.
Identifying and fixing vulnerabilities before an incident costs a fraction of the damage from a real breach. A well-executed pentest shows exactly where the risks are and how to prioritize them.
Go deeper
Understand the differences between a point-in-time pentest and PTaaS, how each modality works and what to consider before contracting.
Read moreIn a landscape where cyber threats evolve constantly, companies face a critical decision: how to structure their penetration tests (pentest) to maximize protection of their digital assets. BrownPipe Consultoria, a cybersecurity firm with over 13 years of experience, presents an analysis of two approaches that are gaining ground in the market.
Read moreConducting annual or periodic penetration tests solely to meet regulatory requirements such as PCI DSS, HIPAA, or ISO 27001 does not guarantee effective protection against vulnerabilities introduced after the last assessment. Recent reports show a significant increase in exploit activity, revealing that point-in-time tests leave gaps for attacks since they cannot keep pace with the speed at which new vulnerabilities emerge.
Read moreContent reviewed on
Get in touch