Web & API pentest
Manual plus automated, with reproducible evidence for every finding.
Pentest and cybersecurity
Cybersecurity with judgement, not smoke
We assess, prioritize and help fix. Manual and automated pentest of web apps and APIs with a launch offer: no high or critical findings, COP $0.
Guarantee COP $0 with no high findingsScope Web · APIsRetest 1 in paid assessments
In short
Slash Digital Lab provides cybersecurity services for companies from Bogotá, and honest security starts with actually looking: manual and automated testing on your real surface, with validated impact and clear priorities. If we find no high or critical vulnerabilities, the assessment costs nothing.
The full launch offer (COP pricing, scope, retest) lives on the Pentest Colombia page. For the new risks: deepfake fraud, prompt injection in AI agents and your AI supply chain.
What we deliver
What the practice includes
From test to report, from patch to retest: security that ends in a fix.
Hardening
Configuration, dependencies, secrets and exposed surface.
Incident response
Containment, analysis and reporting when something blows up.
Human factor
Controlled phishing and social engineering, from COP $5M.
How we work
How an assessment runs
Scope
Domains, apps and APIs in a signed document; nothing outside contract.
Assessment
Manual plus automated; every finding validated and reproducible.
Report
Executive and technical: evidence, impact, priority.
Retest
Verification after patching. Included in paid assessments.
471.5Mattack attempts per year in Colombia (CRC/FortiGuard)
1.3Mattempts per day
COP $0if no high findings
1retest included in paid assessments
Scope and deliverables
The assessment, in writing
| Scope | Web apps and APIs, in a signed document. |
|---|---|
| Method | Manual plus automated, hand-validated. |
| Severity | CVSS and business context. |
| Report | Executive + technical with evidence. |
| Retest | 1 included in paid assessments. |
| Extras | Controlled phishing from COP $5M. |
Frequently asked questions
The questions we hear often
What if you find nothing?
You keep the full report with medium, low and informational findings, at no cost.
How is the price calculated?
COP $0 with no high findings; COP $5M for one; capped at COP $9M. Details on the Pentest page.
Do you test APIs?
Yes, together with the web: that's where the expensive doors open today.
Do you run simulated phishing?
Yes, from COP $5M, with a report and team training.
Do you help remediate?
Yes: we can prepare an independent remediation proposal.
How do you decide a finding is high or critical?
With CVSS adjusted to your business context, and only if the finding is validated by hand and reproducible within the signed scope. Every high or critical finding ships with the steps to reproduce it, so your team can check it independently before it counts toward the price.
Who do we talk to about a pentest, and in which language?
Esteban Zuleta, co-founder: he takes your request, does the first read and confirms scope and pricing in COP. The service is delivered in Spanish, English and French, and the output is an executive and technical report with evidence, impact and priority.
Do you assess mobile apps or other systems?
The launch offer covers web apps and APIs; other scopes are quoted separately. What's in goes into a signed document listing domains, apps and APIs, and nothing outside the contract gets tested. For the human factor, controlled phishing and social-engineering tests start at COP $5 million.
Related capabilities
Where to next
Pentest
Pentest Colombia
Web & API pentest with guaranteed results: no high findings, COP $0.
Learn more→ CybersecurityWhat to test in a web and API pentest
Not a scanner PDF: web apps and APIs, manual validation of every finding and a retest, priced on the outcome.
Learn more→ CybersecurityDeepfake fraud: a protocol for companies
From Arup's $25.6M loss to FBI figures: how cloned-voice and deepfake fraud works, and a verification protocol for finance, HR and executive assistants.
Learn more→ SoftwareCustom software
We replace SaaS licenses with owned products your team controls.
Learn more→
Talk to Slash
Let's put it in production
Tell us your challenge. We reply within 24 business hours with an honest first read: if we can help, we'll say how; if not, we'll say who can.
I reply personally. No endless forms, no canned replies.