Dealing with an incident right now? Email [email protected] and mark it as urgent

Results you can verify

Real cases, anonymized

Q: Why are the case studies anonymous?

Because what we know about each client's security is confidential. That is why we present the cases without names or details that could identify the client, and we show one case per client.

Q: Can my company expect the same results?

Each case shows what happened at that organization, and every company is different. What carries over is the method: we search the way an attacker would, tell you what to fix and verify what was closed at the retest.

Q: What is a retest?

A retest means testing what we found again, after the fixes, to verify what was closed and what is still open. Every ethical hacking engagement includes a one-month remediation window, 2 to 10 hours of remediation support and a retest at no cost up to three months later.

Q: Can I see what a report looks like?

Our clients' reports are confidential. On the managed security program page, you can see a sample monthly report with fictitious data.

Q: How do I start if my company has a similar case?

With the free 30-minute consultation: you tell us what you need to solve, and our engineering team suggests where to start. If you want to continue, we define the scope and send you a written proposal.

Six cybersecurity cases at companies and organizations, each from a different client: what was happening, what we did, the result and what remained open.

Request a free 30-minute consultation

Free 30-minute consultation. We reply during business hours.

These are real cases from Pralogy, a cybersecurity firm headquartered in Miami, with an office in Bogotá, Colombia. They cover a compromised corporate email system, three penetration tests with retests, a secure code review and servers exposed to the internet. We present them without names, with what we did and what was left to do.

Documented case

Incident response

Compromised corporate email: contained the same day

Organization with sensitive data

< 1 hour

All staff received the alert in under 1 hour. Containment came the same day, and the preliminary forensic report in 2 days.

These times are from this case, not a response-time commitment. The client reported no disruption to its operations.

Situation: The organization's corporate email was compromised.
What we did: We alerted all staff, contained the incident and performed the digital forensic analysis. Then we supported the organization with its reporting obligations and trained its staff.

See how we handle an incident

Documented case

Penetration testing

A cloud application, tested and tested again

Organization with a cloud application

Most

of the findings were remediated at retest. The rest were partially fixed.

Situation: It commissioned an ethical hacking engagement on its cloud application.
What we did: We tested the application the way an attacker would. We delivered each finding with its severity and how to fix it. After the fixes, we tested again.
What remained open: Completing the partial fixes.

See penetration testing

Documented case

Penetration testing

Internal and external infrastructure: everything remediated at retest

Technology company

All remediated

The retest verified that every finding in the report was remediated, in both its internal and external infrastructure.

These results are from this case.

Situation: It commissioned an ethical hacking engagement on its internal infrastructure and on the infrastructure it exposes to the internet.
What we did: We tested both the way an attacker would. We delivered each finding with its severity and how to fix it. We verified the fixes with the retest.
What remained open: None of the findings in the report.

See penetration testing

Does your company need to solve something similar?

Free 30-minute consultation. Tell us about your situation. Our engineering team handles your request.

Request a free 30-minute consultation

Free 30-minute consultation. We reply during business hours.

Documented case

Penetration testing

A large organization: progress verified at every retest

Large organization with dozens of assets

Gradual closure

At the first retest, some findings were closed, others showed progress and others were still open. More retests followed.

Situation: It commissioned an ethical hacking engagement covering dozens of assets.
What we did: We delivered each finding with its severity and how to fix it. We scheduled successive retests and, in each one, showed what was closed and what was still open.
What remained open: What did not close at the first retest moved on to the following retests.

See penetration testing

Documented case

Secure code review

An application reviewed from the inside and while running

Software firm

Root causes

A few design decisions explained most of the findings. With the application running, issues appeared that the code did not show, such as a parallel production environment outside the protected perimeter.

Situation: Before treating its application as secure, it wanted to know how exposed it was.
What we did: We reviewed the code and the third-party components it uses. We tested the running application with different user roles. Then we ran the retest.
What remained open: Some findings were left with a remediation commitment. In the retest, we kept them separate from what was fixed and verified.

See secure code review

Documented case

Vulnerability assessment

Databases and admin panels no longer visible from the internet

Organization with its own servers exposed to the internet

None left open

At retest, no finding was still open. The databases and admin panels were no longer visible from the internet.

Situation: A vulnerability assessment found databases, a security console, password-based remote access and application ports open to the internet.
What we did: We delivered each finding with its severity and how to fix it. After the fixes, we tested again from the internet. Some were closed with compensating controls that reduce the risk.
What remained open: Verifying from the internal network what cannot be verified from the internet.

See vulnerability assessment

ISO 27001: clients who achieved certification

We have completed projects in which the client achieved ISO 27001 certification. An accredited certification body grants the certification; we prepare the company and support it throughout.

See how we prepare you for certification

What the retests and returning clients show

73%(81 of 111) of findings closed at retest, across 8 retests documented through August 2026
5clients repeat their ethical hacking every year or every six months
74%(29 of 39) of billed clients hired us again or have more than one invoice
8clients with more than 2 years of continuous relationship

Aggregated figures, without client names. The 73% comes from ethical hacking retests; the 74%, from all billed clients.

Managed security program

Keep open items moving after the report

A security team for your company, all year. We test what changes, follow up on open items and, if something happens, we already know your environment. Every month we show you the progress.

See the managed security program

Frequently asked questions

Why are the case studies anonymous?

Because what we know about each client's security is confidential. That is why we present the cases without names or details that could identify the client, and we show one case per client.

Can my company expect the same results?

Each case shows what happened at that organization, and every company is different. What carries over is the method: we search the way an attacker would, tell you what to fix and verify what was closed at the retest.

What is a retest?

A retest means testing what we found again, after the fixes, to verify what was closed and what is still open. Every ethical hacking engagement includes a one-month remediation window, 2 to 10 hours of remediation support and a retest at no cost up to three months later.

Can I see what a report looks like?

Our clients' reports are confidential. On the managed security program page, you can see a sample monthly report with fictitious data.

How do I start if my company has a similar case?

With the free 30-minute consultation: you tell us what you need to solve, and our engineering team suggests where to start. If you want to continue, we define the scope and send you a written proposal.

Let's talk about your company's security

Tell us what you need to solve. If a client or an auditor gave you a deadline, add it under “Add details”. Our engineering team handles your request.

What happens next: we reply during business hours to set a time. If you want to continue, we define the scope and send you a written proposal.

Request your free 30-minute consultation

Fields marked with * are required.

Name

Company or organization

Contact email

Your work email, preferably. A personal email also works.

Phone

Optional, if you prefer a phone call.

What do you need?

If you are not sure, choose the last option.

When do you need it?

Add details (optional)

Did someone ask you for this?

Tell us what you were asked for and by when

Do not include passwords or confidential information.

I authorize Pralogy LLC to process my personal data to respond to this request, contact me about it and know which page or ad brought me here, including through providers that may process it outside the United States, under its Privacy Policy.

You can access, correct or delete your data by writing to [email protected].

Free 30-minute consultation. We reply during business hours.

We work with companies and organizations, and we also train our clients' staff.

Prefer email? [email protected]