Skip to content
Home / Services / EHT
Services

Penetration Testing Services in Brazil — EHT by Berghem

Penetration testing in Brazil is the authorized simulation of real attacks against your applications, APIs, networks and cloud to prove exploitable risk before criminals do. Berghem delivers it manually from São Paulo as Ethical Hacking Tests (EHT), mapped to LGPD, BACEN 4.893/538, PCI DSS and ISO 27001.

EHT starts from the adversarial objective, not from the URL — the investigation starts from the critical asset that must not be compromised and correlates every route capable of reaching it — technical, identity, business-rule and process routes.

Why Berghem

Why hire Berghem as your penetration testing company

Hiring Berghem as your penetration testing company gives you a Brazilian offensive team, based in São Paulo, that runs manual penetration tests driven by an adversarial objective. You get reproducible evidence, CVSS severity, a remediation roadmap and included retests — using OWASP, MITRE ATT&CK and NIST SP 800-115 to reduce business risk, not just produce a list of findings.

Compliance

How a Brazil-based pentest supports LGPD, BACEN and ISO 27001

A Berghem EHT engagement produces the technical evidence Brazilian regulators expect: reproducible findings, CVSS severity and a remediation roadmap that map to LGPD security obligations, the BACEN/CMN cybersecurity resolutions (including 4.893), PCI DSS and ISO 27001 controls. You get proof of exploitable risk, not a compliance checkbox.

  • ✓LGPD — evidence of risk to personal data and support for the Art. 46 security measures.
  • ✓BACEN/CMN cybersecurity resolutions, including 4.893 — testing for regulated financial institutions.
  • ✓PCI DSS — control validation for environments that process cardholder data.
  • ✓ISO 27001 — technical input for the security controls and the ISMS.
Brazil-based firm

Why choose a Brazil-based penetration testing firm

If your applications, users or data live in Brazil, a São Paulo-based team tests in your time zone, reads the regulations in their original language and knows the local threat and fraud landscape. Berghem delivers manual, adversarial EHT aligned to Brazilian and international standards, communicating findings clearly to both technical and business stakeholders.

Concept

What is a penetration test (pentest)?

A penetration test (pentest) is the authorized simulation of a real attack against applications, APIs, networks and cloud to prove, with evidence, which flaws an adversary would exploit and the business impact. Unlike an automated scan, a pentest combines manual technique, vector chaining and controlled proof of impact, always within agreed rules of engagement.

Read: what is a pentest · Types of pentest

Plans · Engagement Depth

Three tiers, one philosophy: Anticipate attacks before they impact your business

Each plan evolves in methodology, scope, and retest duration — not in volume of promises. Compare and choose by the threat model you need to cover.

Recommended
Gold

Advanced

Critical Environments

MethodologyOWASP ASVS L2 + STRIDE
Retests2 / 90 days
Timeline3–4 weeks
  • ✓OWASP ASVS Level 2 coverage
  • ✓STRIDE threat modeling
  • ✓Business logic analysis
  • ✓2 retests within 90 days
  • ✓Detailed remediation roadmap
  • ✓Priority support (3–4 weeks)
AI Add-on Prompt injection and data leakage in AI/LLM
Request assessmentRequest quote
Diamond

Complete

Critical & Regulated Environments

MethodologyOWASP ASVS L3 + Advanced Security Analysis
RetestsUnlimited / 6 months
Timeline4–6 weeks
  • ✓Full OWASP ASVS Level 3 coverage
  • ✓Business-oriented threat modeling
  • ✓Deep business logic and fraud analysis
  • ✓Unlimited retests for 6 months
  • ✓Executive + technical reports
  • ✓Dedicated security consultant
  • ✓Source-code-assisted analysis
  • ✓Compliance mapping (PCI-DSS, ISO 27001)
AI Add-on Full AI security assessment (LLM, RAG, agents)
Request assessmentRequest quote
Cost

How much does a pentest cost?

A pentest has no fixed price: it depends on scope and depth factors, not a single price list. Describe your environment and we recommend the right tier before any quote. The main cost drivers are:

  • ✓Scope size and complexity — number of applications, APIs, hosts and business flows.
  • ✓Methodology level and depth — from OWASP Top 10 (Silver) to OWASP ASVS Level 3 (Diamond).
  • ✓Asset criticality and regulatory context — LGPD, PCI-DSS, ISO 27001 and the BACEN/CMN cybersecurity resolutions, including 4.893.
  • ✓Included retests and the remediation validation window.
  • ✓Timeline and delivery urgency.

Read: how much a pentest costs

Types

Types of penetration testing

Penetration testing covers different targets, each with its own methodology and attack surface. Berghem scopes web, API, network, mobile and cloud engagements — individually or combined — so the test matches where your real exposure lives.

  • ✓Web application pentest — OWASP Top 10, authentication, authorization and business logic flaws.
  • ✓API pentest — REST, GraphQL and the OWASP API Security Top 10 risks.
  • ✓Network pentest — external and internal infrastructure, segmentation and lateral movement.
  • ✓Mobile pentest — Android and iOS following OWASP MASVS/MASTG.
  • ✓Cloud pentest — cloud configuration, identity and exposed services.
Scoping

Indicative scoping ranges

We size an engagement by effort, not by a fixed price list. Indicative ranges depend on the drivers below; we confirm the exact scope after reviewing your environment. No price is committed before that review.

  • ✓Number of applications, APIs, hosts and user roles in scope.
  • ✓Methodology depth — from OWASP Top 10 (Silver) to OWASP ASVS Level 3 (Diamond).
  • ✓Environment criticality and regulatory context (LGPD, PCI-DSS, ISO 27001, BACEN).
  • ✓Whether testing is external, internal, or both.
  • ✓Included retests and the remediation validation window.
Deliverable

Sample deliverable

Every engagement ends in a report you can act on. A Berghem pentest deliverable pairs an executive summary for decision-makers with a technical section that lets engineers reproduce and fix each finding.

  • ✓Executive summary — risk posture and business impact in plain language.
  • ✓Findings ranked by CVSS severity with reproducible proof of impact.
  • ✓Step-by-step evidence: payload, request, response and affected assets.
  • ✓Prioritized remediation roadmap with practical guidance.
  • ✓Compliance mapping (LGPD, PCI-DSS, ISO 27001) and included retests.

Pentest scopes: API Pentest · Cloud Pentest · Mobile Pentest · Network Pentest

What it is

Manual offensive validation conducted by offensive security specialists — not an automated checklist scan.

Who it's for

Startups validating launch, companies in compliance, and banks in critical exposure.

What you get

Report with evidence, CVSS severity, remediation roadmap, and included retests.

How we attack · A REAL EXCERPT

Not a theoretical test
It's that log that will hit your SIEM

Every engagement generates reproducible evidence: payload, request, target response, proof of impact. This is an excerpt from a real Gold session (sanitized).

▶ ENGAGEMENT · LIVE TRACECWE-89 · OWASP A03:2021
# 14:32:07 — Reconhecimento da superfície de aplicação
$ berghem-recon --target app.cliente.com.br --depth 3
[+] 142 endpoints · 8 com input dinâmico · 3 com auth quebrada

# 14:47:21 — Identificada lógica de autorização por parâmetro de URL
$ curl -s "https://app.cliente.com.br/api/v2/orders?account_id=1043"
{ "status": "ok", "items": [ { "id": 88291, "value": 14580.00 } ] }

# 14:48:02 — IDOR confirmado: troca account_id devolve dados de terceiros
$ curl -s "https://app.cliente.com.br/api/v2/orders?account_id=1042"
{ "status": "ok", "items": [ { "id": 88112, "value": 9230.50, "owner": "outro_cliente" } ] }

# 14:51:14 — Severidade: ALTA · CVSS 8.1 · Exploração: trivial · Escopo: PII + transações
[✓] Evidência capturada · ticket BRG-2826 aberto · cliente notificado em <15min
Methodology · 6 PHASES

From NDA signing to final report, every step is mapped

We combine OWASP, NIST SP 800-115, and PTES with our offensive expertise — no magic black-box, no elastic scope.

01

Pre-engagement

Scope, rules of engagement, written authorization, windows and contacts.

02

Reconnaissance

Attack surface: assets, subdomains, integrations, leaks.

03

Enumeration

Technologies, versions, endpoints, authentication flows and data.

04

Exploitation

Manual validation, vector chaining, proof of impact.

05

Post-exploitation

Lateral movement and escalation within the authorized perimeter.

06

Report

Prioritized findings, evidence, executive and technical roadmap.

Coverage · DEPTH MATRIX

Everything each plan tests, side by side

No fine print. What is marked is executed and documented in the final report.

Test AreaSilverGoldDiamond
OWASP Top 10 (Web)●●●
OWASP API Security Top 10◐●●
OWASP ASVS Level 2—●●
OWASP ASVS Level 3 (full)——●
STRIDE Threat Modeling—●●
Business Logic Analysis—●●
Transactional Fraud Detection——●
Source-code-assisted analysis——●
PCI-DSS / ISO 27001 Mapping—◐●
AI / LLM Security Add-on◐●●
Retests1 in 30 days2 in 90 daysUnlimited / 6 months
● Included◐ Partial / scoped— Not included
COMPLEMENTARY

Pentest and EHT start in different places.

They are complementary approaches. The difference lies in the starting point, the methodology and the success criteria.

Pentest

Starts from an asset, application, API or infrastructure.

  • Question: where can this environment be compromised?
  • Evidence: vulnerability, exploitation and impact.

Berghem EHT

Starts from the adversarial objective and the business-critical asset.

  • Question: what can an adversary reach, and through which combinations?
  • Evidence: the chain of conditions leading to impact.
FRAMEWORK

CORE: from the critical asset to the evidence.

Berghem structures business-driven missions across four connected dimensions.

C

Core business

Money, data, identity, critical operations, trust and secrets.

O

Orchestration

Specialists, agents, models, tooling and authorized sources.

R

Routes

Technology, identities, rules, processes, controls and context.

E

Evidence

Logged actions, understandable impact, reproduction and recommendation.

CONTROL

Sufficient evidence, controlled impact.

The mission ends when the evidence criterion is met or when a boundary requires human intervention.

Deliverables

  • Route and hypothesis map.
  • Reproducible proofs.
  • Technical and business impact.
  • Recommendations and retest.

Rules of engagement

  • Permitted and blocked actions.
  • Segregated identities.
  • Time and volume limits.
  • Approval and stop conditions.

Frequently Asked Questions

What's the difference between Silver, Gold, and Diamond?
The three EHT tiers differ in methodology depth, retest coverage, and engagement duration. Silver delivers OWASP Top 10 testing with automated and manual techniques, one retest within 30 days, and 2–3 week delivery — ideal for startups and basic compliance needs. Gold adds OWASP ASVS Level 2 coverage, STRIDE threat modeling, and business logic analysis, with two retests across 90 days over a 3–4 week engagement. Diamond is the most comprehensive tier, with full OWASP ASVS Level 3, deep fraud detection, unlimited retests for six months, source-assisted review, and compliance mapping for PCI-DSS and ISO 27001.
Which tier should I choose?
The right tier depends on your security maturity, compliance requirements, and the criticality of the system being tested. Startups and early-stage products with basic compliance obligations are usually served well by Silver. Mid-size companies with production systems handling customer data and moderate regulatory exposure typically choose Gold, which is our most popular tier. Financial institutions, enterprises, and organizations subject to strict regimes like PCI-DSS or ISO 27001 should choose Diamond for its depth and compliance mapping. If you are unsure, our consultants will assess your environment and recommend the right tier at no cost.
Do you offer retests?
Yes. Retesting is included in every EHT tier so you can verify that remediation actually closed the findings. Silver includes one retest within 30 days of the initial report. Gold includes two retests within 90 days, giving teams more time to fix and validate. Diamond offers unlimited retests for six months, recognizing that enterprise and financial environments often require iterative fixes across multiple teams and change windows. Retests are conducted using the same methodology as the initial engagement, and we update the final report to reflect the current state of each finding.
How long does a pentest take?
Engagement length varies by tier and scope. A Silver test typically runs for 2–3 weeks from kickoff to final report, including reconnaissance, testing, reporting, and debrief. Gold takes 3–4 weeks due to deeper methodology and threat modeling. Diamond runs for 4–6 weeks, covering full OWASP ASVS Level 3 coverage, business logic and fraud testing, and source-assisted review. We also factor in a kickoff meeting to align on scope and rules of engagement, and a closing session to walk stakeholders through findings. Rush timelines can be accommodated when necessary and commercially reasonable.
Do you test mobile apps?
Yes. Berghem tests mobile applications across Android and iOS as part of our EHT engagements, including native apps, hybrid apps, and mobile SDKs. We follow the OWASP MASVS and MASTG methodology, covering insecure data storage, insecure communication, authentication and session management, cryptography, code tampering, reverse engineering resistance, and runtime protections like SSL pinning and root or jailbreak detection. Mobile testing can be scoped standalone or as part of a broader engagement that also includes backend APIs and web admin panels, giving you coverage across the full mobile application stack.
What is a penetration test (pentest)?
A penetration test (pentest) is the authorized simulation of a real attack against applications, APIs, networks and cloud to prove, with evidence, which flaws an adversary would exploit and the business impact. Unlike an automated scan, it combines manual technique, vector chaining and controlled proof of impact within agreed rules of engagement.
How much does penetration testing cost in Brazil?
A pentest's price is set by scope: number of IPs, endpoints or applications, target type (web, API, mobile, network), depth (Silver, Gold or Diamond), duration and included retests. Berghem quotes by adversarial objective and an hours bank, with a proposal within 48 hours.
How do I hire a penetration testing company?
Define the critical assets and the objective of the test, require a methodology (OWASP, PTES, MITRE ATT&CK), team certifications, a sample report, a retest policy and an NDA. Berghem delivers a proposal with scope, timeline and success criteria before the engagement begins.
What's the difference between a pentest and a vulnerability assessment?
A vulnerability assessment uses scanners to list known flaws. A pentest exploits the flaws manually, chains vulnerabilities and demonstrates real business impact, with reproducible evidence and a prioritized remediation plan.
Why hire Berghem as your penetration testing company?
Berghem is a Brazilian offensive team based in São Paulo that runs manual, adversarial-objective penetration tests. You get reproducible evidence, CVSS severity, a remediation roadmap and included retests, using OWASP, MITRE ATT&CK and NIST SP 800-115 to reduce business risk — not just a list of findings.
Does penetration testing satisfy LGPD and BACEN requirements?
Yes. An EHT engagement delivers reproducible evidence, CVSS severity and a remediation roadmap that support LGPD security obligations and the BACEN/CMN cybersecurity resolutions, including 4.893. We also map findings to PCI DSS and ISO 27001 controls so your audit and regulatory teams get technical proof, not just a checklist.
Why hire a Brazil-based pentest firm?
A São Paulo-based team tests in your time zone, reads Brazilian regulations in the original language and understands the local threat and fraud landscape. If your applications, users or data are in Brazil, Berghem delivers nearshore, manual EHT aligned to both Brazilian and international standards.

EHT for AI applications

The ethical hacking test methodology applied to models, agents and AI integrations.

Not Sure Which Plan to Choose?

Our security consultants will assess your environment, compliance requirements, and risk profile to recommend the ideal plan for your organization.

Talk to a Specialist