In-house team
An in-house team of offensive and defensive specialists — no outsourcing of the technical work. The people testing your environment are Berghem's own, with real MITRE ATT&CK and OWASP experience.
Information security · São Paulo
Information security company in São Paulo
Berghem is an information security company headquartered in Pinheiros, São Paulo, Brazil, helping organizations across the country find and fix vulnerabilities before attackers do — through penetration testing, Red Team, regulatory compliance, incident response and AI systems security, delivered with auditable evidence and remediation prioritized by business risk.
What is an information security company?
An information security company identifies, assesses and reduces an organization's cyber risk. In practice that combines penetration testing, Red Team exercises, compliance auditing, incident response and ongoing advisory — always backed by technical evidence and business-risk prioritization.
Berghem operates from São Paulo with a team of offensive and defensive specialists. Every engagement delivers not just a list of vulnerabilities, but the impact context, proof of exploitation and the remediation path — so engineers can fix and leadership can understand the risk. We serve technology, financial services, retail, healthcare and public-sector organizations, with scope tailored to each client's environment and regulatory obligations.
Why Berghem
•Headquartered in São Paulo (Pinheiros), nationwide reach
•Penetration testing, Red Team, Blue Team and Purple Team
•Compliance: PCI-DSS, ISO 27001, LGPD and BACEN
•Incident response and digital forensics
•AI Security — LLM pentest and Red Team
•Actionable reports with auditable evidence
Services
What Berghem delivers
A complete information security company covers the whole cycle — from simulated attack to remediation and compliance. These are the services most requested by companies in São Paulo and across Brazil.
Penetration testing (pentest)
We run controlled attacks against web apps, APIs, networks, cloud and mobile to find exploitable vulnerabilities, with proof of concept and prioritized recommendations.
Red Team
Objective-driven adversary simulation — we test not only technical flaws but your defense team's ability to detect and respond to a real attacker.
Compliance and audit
Gap analysis and regulatory testing for PCI-DSS, ISO 27001, LGPD and BACEN rules, with auditable evidence ready for an external auditor, QSA or regulator.
Incident response
Containment, investigation and recovery from security incidents, with digital forensics and root-cause analysis to prevent recurrence.
Financial services security
Testing and adequacy aligned with BACEN requirements and the realities of banks, fintechs and payment providers operating under regulation.
AI Security
Pentest and Red Team for LLM, RAG and AI-agent applications, assessing risks such as prompt injection and data leakage against the OWASP LLM Top 10.
Services in detail
Cybersecurity consulting
Berghem's cybersecurity consulting helps your company set priorities, design controls and mature its security program end to end. We assess the attack surface, maturity level and regulatory obligations before recommending any investment — so every dollar spent reduces real risk rather than just ticking a checklist. Advisory is continuous and tailored to your sector.
Pentest and Ethical Hacking Tests (EHT)
Penetration testing, or Ethical Hacking Tests (EHT), simulates controlled attacks against web apps, APIs, networks, cloud and mobile to find exploitable vulnerabilities before attackers do. Every finding comes with proof of concept, impact evidence and a prioritized recommendation. We work in tiers matched to the required depth, always aligned with OWASP and MITRE ATT&CK.
Information security audit
An information security audit verifies whether controls exist, work and withstand a real attacker. We combine technical review, regulatory testing and gap analysis to produce auditable evidence ready for an external auditor, QSA or regulator. Unlike a one-off pentest, the audit looks at the whole program — policy, process and technology — and points to the remediation path.
LGPD and ISO 27001 readiness
LGPD and ISO 27001 readiness takes more than documents: it takes implemented, evidenced controls. Berghem runs gap analysis, defines the treatment plan and validates each control with technical testing, from initial diagnosis to sign-off. We also cover PCI-DSS and the BACEN/CMN cybersecurity rules, with evidence that supports certification and supervision.
AI security
AI security assesses applications built on LLM, RAG and autonomous agents against risks such as prompt injection, data leakage and tool abuse, following the OWASP LLM Top 10 and MITRE ATLAS. We run pentest and Red Team on these systems and help establish governance aligned with emerging standards, so adopting AI in your company does not open a new attack surface.
Differentiators
Why hire an information security company in São Paulo
Choosing an information security company means choosing who will see your environment the way an attacker would. These four points define Berghem's work.
Local presence
Local presence in São Paulo (Pinheiros), at the heart of Brazil's financial and technology sector, easing meetings, on-site testing and alignment on Brazilian regulatory context.
Nationwide reach
Nationwide reach: most services run remotely, with the same technical depth, for clients across Brazil and Latin America.
Berilo in Europe
Berilo in Europe: through the Berilo subsidiary in Bergamo, Italy, we serve European-market operations with the same methodology and technical standards.
Industries served
Industries served
Berghem tailors the scope of each engagement to the client's industry — because the risks, regulations and attack surface of a bank are not those of a healthtech or a public body.
We are the information security company that tests and adapts the regulated environments of financial institutions, while also serving healthcare, government, technology and retail.
São Paulo
Why choose a company from São Paulo
São Paulo concentrates most of Brazil's financial, technology and services sector — and with it much of the national attack surface. Working with an information security company based in the city eases alignment on time zone, language, Brazilian regulatory context (LGPD, BACEN) and, when needed, on-site testing of critical environments.
Berghem is located in Pinheiros and serves clients across the São Paulo metropolitan area, the rest of Brazil and Latin America, plus operations in Europe through its Berilo subsidiary. Most services run remotely with the same technical depth; on-site activities are arranged according to scope and criticality.
Berghem — São Paulo
•Rua Paes Leme, 136, Cj 308 — Pinheiros, São Paulo/SP
•CEP 05424-010
FAQ
Frequently asked questions
What does an information security company do?
An information security company identifies, assesses and reduces cyber risk. In practice that includes penetration testing, Red Team, compliance auditing and incident response. Berghem delivers each service with technical evidence, risk prioritization and actionable remediation recommendations.
Does Berghem serve companies outside São Paulo?
Yes. Although headquartered in São Paulo, Berghem serves clients across Brazil and Latin America, plus operations in Europe via its Berilo subsidiary. Most services run remotely; on-site testing is arranged according to scope and the criticality of the environment.
How much does cybersecurity consulting cost?
The cost of cybersecurity consulting depends on scope: number of applications, APIs, networks or devices, test depth, retest needs and regulatory requirements. We don't use list pricing — we map your environment in an initial conversation and design a scope proportional to risk before quoting.
How does Berghem help with regulatory compliance?
Berghem covers PCI-DSS, ISO 27001, LGPD and the BACEN/CMN cybersecurity rules, including Resolution 4.893. We run gap analysis, regulatory testing and produce auditable evidence for the external auditor, QSA or regulator — from initial diagnosis to sign-off.
What is the difference between pentest and a security audit?
A pentest seeks the maximum number of exploitable vulnerabilities within a defined scope, with proof of concept. An information security audit verifies whether controls exist, work and meet standards such as ISO 27001 and LGPD, with auditable evidence. The pentest shows what an attacker could do; the audit shows whether your security program is compliant.
Need an information security company in São Paulo?
In a 30-minute conversation we map your environment and design the ideal scope — from penetration testing to regulatory adequacy.