We attack your systems before they do.

Cybersecurity services for companies worldwide: penetration testing, vulnerability assessments, compliance readiness and SOC monitoring with incident response. Delivered by engineers who also ship production software, in English and Spanish, across every time zone.

Real findings. Actionable reports. Re-test included.

kilauea / security-assessment
$ kilauea scan --scope app.client.com --profile owasp-asvs-l2
recon: 14 subdomains · 38 endpoints · 3 exposed services
✓ TLS 1.3 · HSTS preload · security headers OK
! MEDIUM · CVSS 5.3 · no rate limit on /api/login
✗ CRITICAL · CVSS 9.1 · IDOR on /api/v2/invoices/:id
! HIGH · CVSS 7.5 · dependency with known CVE (SCA)
✓ executive + technical report generated → remediation plan
✓ re-test scheduled after fix

Illustrative example of a typical finding. Not a real client.

◆OWASP Top 10◆OWASP ASVS◆OWASP MASVS◆NIST CSF◆MITRE ATT&CK◆PTES◆ISO/IEC 27001◆SOC 2◆PCI-DSS◆CIS Controls◆LFPDPPP

Services

Four fronts. One team.

From a one-off test before a launch to an ongoing security program.

01OFFENSIVE

Penetration testing & ethical hacking

We simulate real attacks against your web apps, APIs, mobile apps, internal network and cloud infrastructure. Black, grey or white box, depending on what you need to validate.

  • Web apps & APIs (OWASP Top 10 / API Top 10)
  • iOS & Android apps (OWASP MASVS)
  • Internal, external network & Active Directory
  • AWS, GCP and Azure
02PREVENTIVE

Vulnerability assessment & audits

Systematic review of code, dependencies and configuration to catch flaws before they reach production, wired into your CI/CD pipeline.

  • Secure code review (SAST)
  • Dynamic testing (DAST)
  • Dependencies & supply chain (SCA)
  • Cloud, container and secrets configuration
03COMPLIANCE

Compliance & regulations

Gap analysis, control mapping and hands-on support so your company walks into the audit with evidence, policies and processes in order.

  • ISO/IEC 27001
  • SOC 2 readiness
  • PCI-DSS
  • Mexico LFPDPPP (data protection)
04DEFENSIVE

SOC monitoring & incident response

Continuous visibility into your infrastructure, prioritized alerts and a clear plan to contain, eradicate and recover when something happens.

  • Event monitoring & correlation (SIEM)
  • 24/7 detection and alerting
  • Incident response plans & tabletop drills
  • Forensics and postmortems

Methodology

How we run a pentest.

Scope and rules of engagement signed before we touch a single system.

01 / 05

  1. STEP_01

    Scope & rules

    We define assets, test windows, emergency contacts and limits. Everything in writing and under NDA.

  2. STEP_02

    Reconnaissance

    We map the attack surface: domains, endpoints, technologies, exposed services and leaked credentials.

  3. STEP_03

    Controlled exploitation

    Every vulnerability is validated by hand to remove false positives and measure real impact, without disrupting your operation.

  4. STEP_04

    Reporting

    An executive report for leadership and a technical one for engineering, with CVSS severity, evidence and reproduction steps.

  5. STEP_05

    Remediation & re-test

    We support your team through the fix and test again to confirm every finding is closed.

Deliverables

What you get at the end.

> 01.pdf

Executive report

Business risk in plain language for leadership and the board.

> 02.pdf

Technical report

Each finding with CVSS, evidence, reproduction steps and CWE reference.

> 03.pdf

Remediation plan

Prioritized by impact and effort, with concrete code-level recommendations.

> 04.pdf

Re-test & attestation letter

We verify the fixes and issue a letter you can share with customers or auditors.

FAQ

Cybersecurity, straight answers.

Kilauea Tec Lab offers four cybersecurity services: penetration testing of web apps, APIs, mobile apps, networks and cloud; vulnerability assessments and audits (SAST, DAST, SCA); compliance readiness for ISO 27001, SOC 2, PCI-DSS and Mexico's LFPDPPP; and SOC monitoring with incident response.

A vulnerability scan is automated and lists potential issues. A pentest is an attack simulation performed by people: each issue is validated by hand, exploited in a controlled way to measure real impact, and false positives are removed.

It depends on scope. A typical web application or API takes one to three weeks across reconnaissance, testing and reporting. The exact scope is defined on the first call.

Testing runs under signed rules of engagement, in agreed windows and with an emergency contact. Destructive or denial-of-service tests are not performed without explicit authorization, and testing can be done in a staging environment.

Yes. We run the gap analysis, map controls, prepare policies and evidence, and support your team through the audit. The certification itself is issued by an independent certification body.

Yes. Kilauea Tec Lab works with companies around the world, in English and Spanish, fully remote and across time zones. Engagements are run under NDA with written rules of engagement.

All work is under NDA. Reports are delivered encrypted, only to authorized contacts, and evidence is deleted when the engagement closes.

When did someone last try to break in?

Book a 30-minute call. We define scope, timeline and the type of assessment your company needs. We reply within 24 hours.