Documented case
Organization with a cloud application
12 of 14
findings remediated at retest; the other 2, partially fixed
For companies that need to test their security
Penetration testing and ethical hacking for companies
We test your systems the way an attacker would, tell you what to fix first and test again to verify what was closed.
Free 30-minute consultation. We reply during business hours.
Every ethical hacking engagement includes a one-month remediation window, 2 to 10 hours of remediation support and a retest at no cost up to three months later.
Pralogy is a cybersecurity firm headquartered in Miami, with an office in Bogotá, Colombia. We run penetration tests (pentests or ethical hacking) on companies' web applications, mobile apps, APIs (the connections between your systems) and infrastructure. With written authorization, we search the way an attacker would and deliver executive and technical reports. Then we retest what was fixed.
Is your company in one of these situations?
“A large client is asking us for a penetration test before renewing our contract.”
“Our ISO 27001 or PCI DSS (the payment card security standard) audit calls for technical testing.”
“We are launching a new version and want to know whether someone could break in.”
“We had a penetration test years ago, and no one checked whether the findings were fixed.”
Tell us what you are being asked for and by when. In the free 30-minute consultation, we talk about what you need to test and which requirement you must meet.
Request a free 30-minute consultation
Free 30-minute consultation. We reply during business hours.
What is included and what you receive
Executive report
For management, your client or the auditor: what was tested, what was found and how serious it is.
Technical report
For the people who make the fixes. Each finding comes with its severity and how to fix it.
Findings grouped by root cause
So you can fix each problem at its source.
The defenses that worked
We also tell you which controls held up.
Remediation support and retest
Every ethical hacking engagement includes a one-month remediation window, 2 to 10 hours of remediation support and a retest at no cost up to three months later.
How we do it
Written scope
We define what is tested, how, what you receive and by what date.
Signed rules of engagement
Written authorization, a nondisclosure agreement and a way to stop testing. By default, nothing designed to take you offline.
Attacker-style testing
Before we report a finding, we confirm it, and we state clearly which ones we demonstrated and which ones we did not.
Executive and technical reports
Each finding comes with its severity and how to fix it, grouped by root cause, plus the defenses that worked.
Remediation support and retest
Your team makes the fixes with our support. The retest shows what was closed and what is still open.
Real cases · anonymized
What was closed and what remained open at the retest
Documented case
Technology company with internal and external infrastructure
18 of 18
findings remediated at retest
Documented case
Large organization with dozens of assets
Multiple cycles
progress verified at each retest, until the open items are closed
Anonymized cases from different clients. These results are from each case.
Does your client require a test or a report?
Tell us what they asked for and by when. With that, we define the scope and the deliverables in the proposal.
Free 30-minute consultation. We reply during business hours.
Penetration testing for ISO 27001 or PCI DSS audits
If your auditor or a client asks for technical testing as part of vulnerability management, a penetration test provides the evidence: what was tested, what was found and, with the retest, what was closed. We agree on the scope based on that requirement. If your company is also getting certified, see how we prepare companies for ISO 27001 certification.
- Scope based on the requirement: the systems your certification covers or the ones your client asks for.
- An executive report to present to the auditor or your client, and a technical report for your team.
- A retest with the result of each finding: what was closed and what is still open.
- A nondisclosure agreement signed before we start.
Who runs the tests
Our engineering team runs them. Pralogy has been in business since 2019. Our reference catalog brings together 861 tests across 10 domains. These are certifications held by specialists on our team:
- OSCP (Offensive Security Certified Professional)
- OSWE (Offensive Security Web Expert)
- eWPT (eLearnSecurity Web Application Penetration Tester)
- CEH Practical (Certified Ethical Hacker Practical)
- ISO/IEC 27001 Lead Auditor
- ISO/IEC 27001:2022 Lead Implementer
- Lead Cybersecurity Professional
- ISO/IEC 27001 Foundation
- ISO 22301 Foundation
Vulnerability assessment, penetration testing or adversary emulation
All three are useful, for different purposes. In the free 30-minute consultation, we help you choose.
| Topic | Vulnerability assessment | Penetration testing or ethical hacking | Adversary emulation |
|---|---|---|---|
| What it is | Vulnerability assessmentA tool looks for known weaknesses in what your company exposes. | Penetration testing or ethical hackingSpecialists test the way an attacker would and demonstrate which weaknesses open the door. | Adversary emulationWe emulate, in a controlled way, techniques that real attackers use. |
| What it is for | Vulnerability assessmentTo know what you have exposed and review it often. | Penetration testing or ethical hackingTo know what to fix first and verify at the retest what was closed. | Adversary emulationTo know whether your defenses detect the attack and whether your team responds. |
The same, on an ongoing basis
After the included retest, keep the work going: a yearly plan adds testing of what changes and follow-up on open items.
Frequently asked questions
How much does a penetration test cost, and how long does it take?
It depends on how many applications, servers and users need to be tested. First, we talk in the free 30-minute consultation. If you want to continue, we send you a written proposal with the scope, the cost and the timeline.
What can you test in a penetration test?
Web applications, APIs, mobile apps, external infrastructure and internal networks. We also do adversary emulation. The systems and how they are tested are defined in the scope.
What is the difference between black box and gray box penetration testing?
In black box testing, we test without internal information, like an outside attacker. In gray box testing, we have partial access, for example a user account in the application. We define the approach in the scope.
Can a penetration test take our systems down?
We work under signed rules, with no denial-of-service testing by default (tests that aim to take a system offline) and with a channel to stop testing whenever you ask. If a system is sensitive, its precautions are written into the scope.
What does the retest of a penetration test show?
We test again what was fixed and show you, finding by finding, what was closed and what is still open. The retest and remediation support come with every ethical hacking engagement: see what is included and what you receive.
Does a penetration test help with ISO 27001 or PCI DSS?
Yes. It provides evidence of technical testing for vulnerability management. The executive report can be presented to your auditor or your client, and the scope is designed around the requirement you were given. See how we prepare you for an audit.
Do you fix what the penetration test finds?
Your team makes the fixes, with our support hours. We keep finding and fixing separate so that the people who test do not grade their own work. At the retest, we verify what was closed and what is still open.
Will a penetration test find every vulnerability?
No test can find everything. That is why we search the way an attacker would, tell you what to fix and verify what was closed at the retest.
How often should we run a penetration test?
It depends on how much your systems change and on what your clients or auditors ask for. 5 clients repeat their ethical hacking every year or every six months. If you are about to release something new, it is worth testing it first.
Do you sign a nondisclosure agreement before a penetration test?
Yes, before we start, along with the written authorization to run the tests.
Let's talk about the test you need
Tell us what you need to test, who is asking for it and by when. The consultation is a conversation with our engineering team to understand your situation and suggest where to start.
Every ethical hacking engagement includes a one-month remediation window, 2 to 10 hours of remediation support and a retest at no cost up to three months later.
73% (81 of 111) of findings closed at retest, across 8 retests documented through August 2026.