The investigation starts from the critical asset that must not be compromised and correlates every route capable of reaching it — technical, identity, business-rule and process routes.
Each plan evolves in methodology, scope, and retest duration — not in volume of promises. Compare and choose by the threat model you need to cover.
Startups & Compliance
Compliance ScopeOWASP Top 10 · LGPD-aligned controls · ISO 27001 baseline controls · Essential PCI-DSS controlsCritical Environments
Critical & Regulated Environments
Manual offensive validation conducted by offensive security specialists — not an automated checklist scan.
Startups validating launch, companies in compliance, and banks in critical exposure.
Report with evidence, CVSS severity, remediation roadmap, and included retests.
Every engagement generates reproducible evidence: payload, request, target response, proof of impact. This is an excerpt from a real Gold session (sanitized).
# 14:32:07 — Reconhecimento da superfície de aplicação $ berghem-recon --target app.cliente.com.br --depth 3 [+] 142 endpoints · 8 com input dinâmico · 3 com auth quebrada # 14:47:21 — Identificada lógica de autorização por parâmetro de URL $ curl -s "https://app.cliente.com.br/api/v2/orders?account_id=1043" { "status": "ok", "items": [ { "id": 88291, "value": 14580.00 } ] } # 14:48:02 — IDOR confirmado: troca account_id devolve dados de terceiros $ curl -s "https://app.cliente.com.br/api/v2/orders?account_id=1042" { "status": "ok", "items": [ { "id": 88112, "value": 9230.50, "owner": "outro_cliente" } ] } # 14:51:14 — Severidade: ALTA · CVSS 8.1 · Exploração: trivial · Escopo: PII + transações [✓] Evidência capturada · ticket BRG-2826 aberto · cliente notificado em <15min
We combine OWASP, NIST SP 800-115, and PTES with our offensive expertise — no magic black-box, no elastic scope.
Scope, rules of engagement, written authorization, windows and contacts.
Attack surface: assets, subdomains, integrations, leaks.
Technologies, versions, endpoints, authentication flows and data.
Manual validation, vector chaining, proof of impact.
Lateral movement and escalation within the authorized perimeter.
Prioritized findings, evidence, executive and technical roadmap.
No fine print. What is marked is executed and documented in the final report.
| Test Area | Silver | Gold | Diamond |
|---|---|---|---|
| OWASP Top 10 (Web) | ● | ● | ● |
| OWASP API Security Top 10 | ◐ | ● | ● |
| OWASP ASVS Level 2 | — | ● | ● |
| OWASP ASVS Level 3 (full) | — | — | ● |
| STRIDE Threat Modeling | — | ● | ● |
| Business Logic Analysis | — | ● | ● |
| Transactional Fraud Detection | — | — | ● |
| Source-code-assisted analysis | — | — | ● |
| PCI-DSS / ISO 27001 Mapping | — | ◐ | ● |
| AI / LLM Security Add-on | ◐ | ● | ● |
| Retests | 1 in 30 days | 2 in 90 days | Unlimited / 6 months |
They are complementary approaches. The difference lies in the starting point, the methodology and the success criteria.
Starts from an asset, application, API or infrastructure.
Starts from the adversarial objective and the business-critical asset.
Berghem structures business-driven missions across four connected dimensions.
Money, data, identity, critical operations, trust and secrets.
Specialists, agents, models, tooling and authorized sources.
Technology, identities, rules, processes, controls and context.
Logged actions, understandable impact, reproduction and recommendation.
The mission ends when the evidence criterion is met or when a boundary requires human intervention.
Our security consultants will assess your environment, compliance requirements, and risk profile to recommend the ideal plan for your organization.
Talk to a Specialist