What to really test
Colombia detects roughly 1.3 million attack attempts a day. A scanner is the floor; manual validation is what turns a PDF into decisions.
The question isn't whether your platform is secure, but what you're missing. This piece defines what to really test (web, APIs, manual validation and retest) and how the Slash launch offer aligns price with outcome.
1.3 million attempts a day
Colombia, 2025: 471.5 million attack attempts detected.
Colombia detects roughly 1.3 million attack attempts a day, 471.5 million over the year (source: CRC and FortiGuard Labs). An attempt isn't a successful attack, but every exploitable flaw is a door someone may find before you do.
The regional picture confirms the pressure: according to Check Point Research, in the first half of 2025 organizations in Latin America faced an average of 2,716 attacks per week, 39% above the global average, and Colombia was among the five most targeted countries in the region. Kaspersky, for its part, reports Latin America as the region most affected by ransomware in 2025.
What to actually test
Web apps and APIs, in that order.
An honest test covers your real surface: the web apps in production and the APIs behind them. APIs are where the most expensive doors open today: authentication, authorization, input validation and data exposure. That is the scope of our web and API penetration testing.
Every finding is validated by hand and must be reproducible; severity combines CVSS with business context. What can't be reproduced doesn't get reported.
- Web apps: authentication, sessions and business logic.
- APIs: authorization, IDOR, excessive data exposure and misconfiguration.
- Configuration: headers, TLS, secrets and exposed surface.
- Manual validation of every relevant finding, not just the scanner.
A price aligned with the outcome
COP $0 if no high or critical findings are confirmed.
Our launch offer aligns price with outcome: COP $0 if no high or critical vulnerabilities are confirmed within scope; COP $5M for one high finding; capped at COP $9M however many we find. The assessment always runs in full, with an executive and a technical report, and one retest included in paid engagements.
And the human factor
Controlled phishing and social engineering, from COP $5M.
Technology exposes; people open. We run controlled phishing and social-engineering tests from COP $5 million, with a report and training for your team. With voice cloning and deepfakes this layer matters more every year: see our protocol against deepfake fraud.
Key takeaways
- Test the production web and APIs, not the demo.
- Validate every finding by hand; the scanner is the floor.
- Severity combines CVSS and business context.
- The retest verifies the fixes and is included in paid assessments.
- No high findings means the assessment costs COP $0.
Sources
Editorial note: this analysis reflects the public information available on the review date. Models, prices and rules change fast; every third-party figure links to its source, and our opinions are labeled as such. Spotted an error? Write to contact@slash-digital.io.
The questions we hear often
Is COP $0 real when nothing is found?
Yes: with no confirmed high or critical findings within scope, the assessment is free and you keep the full report.
Where does the statistic come from?
From CRC and FortiGuard Labs (prospective cybersecurity analysis, 2026). An attempt is not a successful attack.
Do you test mobile apps?
The offer covers web apps and APIs; other scopes are quoted separately.
Who fixes the findings?
Whoever you choose: your team, another vendor or Slash. The retest still applies.
Do you sign an NDA?
Yes: scope and confidentiality are signed before testing starts.
More analysis to read next
How AI changes pentesting
What attackers now do with AI, what Mythos, Big Sleep and XBOW find, why validation became the scarce skill and how to adapt your pentest in Colombia.
CybersecurityPrompt injection and agent security: risk number one
Why prompt injection is still unsolved, what the 2025–2026 incidents show and which controls actually work for agents and chatbots.
CybersecurityDeepfake fraud: a protocol for companies
From Arup's $25.6M loss to FBI figures: how cloned-voice and deepfake fraud works, and a verification protocol for finance, HR and executive assistants.
Let's put it in production
Tell us your challenge. We reply within 24 business hours with an honest first read: if we can help, we'll say how; if not, we'll say who can.
I reply personally. No endless forms, no canned replies.