I review what a company exposes, confirm the real risk and stay through to the fix. Everything is done with the client's written authorization, a consent-first approach and a method grounded in recognized standards.
Every service starts with an authorization agreement and ends with something concrete in your hands. The only one with a published price is the Domain Watch. The rest are quoted to measure, based on scope.
A passive review of your public surface, without touching your systems. I look at what an attacker sees first across email, domain, DNS, subdomains and already known leaks.
A sweep of SPF, DKIM and DMARC records, domain and subdomain mapping, a review of headers and TLS, and a cross-check against known public leaks.
A report with findings prioritized by severity and a clear recommendation on where to start.
A penetration test with defined scope and authorization, over specific assets we agree on in writing. Never over production without explicit authorization.
Definition of scope and rules of engagement, controlled exploitation of the authorized assets, and confirmation of the risk with reproducible evidence.
A technical report with the confirmed vulnerabilities, their severity, the evidence and the remediation steps.
Support to close the findings, not just list them. I work alongside your team until the surface is reduced and verified.
Configuration of DMARC, SPF and DKIM, tuning of security headers and TLS, closing exposed services and reducing surface.
The changes applied and verified, plus an attestation of the final state and what was closed.
I train the team to recognize phishing and social engineering, the most common way in. The best technical defense falls apart if one person clicks where they should not.
A hands-on session with real cases, warning signs for email and messaging, and a simple protocol to report anything suspicious.
A trained team and reference material to consult after the session.
Continuous, passive monitoring of your domain. I let you know the moment something changes, before it turns into an incident.
Monthly monitoring of SPF, DMARC, TLS and domain exposure, with an alert whenever a relevant change appears.
A monthly report on the state of the domain and alerts between reports whenever something moves.
Nothing starts without a written authorization agreement. I do not scan third-party assets without permission. The approach is consent-first from beginning to end.
I work with industry standards. PTES for running the pentest, OWASP for the web surface and NIST as the control framework.
I deliver findings prioritized by severity, with evidence and in language management understands, not only the technical team.
I do not drop a PDF and leave. I stay through the closing of the findings and verify that what was fixed is truly fixed.
All work is carried out within the framework of Law 21.459, Chile's cybercrime law, and with the client's prior written authorization. Access, testing and exploitation are limited to the authorized assets and the agreed scope. Outside that agreement, there is no intervention.
Start with an exposure assessment and let's talk through what your case needs. No commitment.
Write to me →