# What to test in a web and API pentest: 2026 checklist Source: https://slash-digital.io/en/insights/pentest-colombia/ Cybersecurity · Updated October 2026 Colombia detects roughly 1.3 million attack attempts a day. A scanner is the floor; manual validation is what turns a PDF into decisions. - 1.3M attempts a day (CRC and FortiGuard) - 471.5M attempts a year - COP $0 with no high findings Start a project All insights Esteban Zuleta, Co-founder, business and finance, Slash Digital Lab Published: September 23, 2026 Updated: October 14, 2026 Reading time: 3 min Topic: Cybersecurity In short Every platform misses something, and a pentest is how you find what yours misses. This piece defines what to really test (web, APIs, manual validation and retest) and how the Slash launch offer aligns price with outcome. For your company Would your application or API withstand these attacks? Slash Digital Lab runs manual pentests of web applications and APIs in Colombia. Pentest Colombia → ## 1.3 million attempts a day Colombia, 2025: 471.5 million attack attempts detected. Colombia detects roughly 1.3 million attack attempts a day, 471.5 million over the year (source: CRC and FortiGuard Labs). An attempt isn't a successful attack, but every exploitable flaw is a door someone may find before you do. The regional picture confirms the pressure: according to Check Point Research, in the first half of 2025 organizations in Latin America faced an average of 2,716 attacks per week, 39% above the global average, and Colombia was among the five most targeted countries in the region. Kaspersky, for its part, reports Latin America as the region most affected by ransomware in 2025. ## What to actually test Web apps and APIs, in that order. An honest test covers your real surface: the web apps in production and the APIs behind them. APIs are where the most expensive doors open today: authentication, authorization, input validation and data exposure. That is the scope of our web and API penetration testing. Every finding is validated by hand and must be reproducible; severity combines CVSS with business context. What can't be reproduced doesn't get reported. - Web apps: authentication, sessions and business logic. - APIs: authorization, IDOR, excessive data exposure and misconfiguration. - Configuration: headers, TLS, secrets and exposed surface. - Manual validation of every relevant finding, not just the scanner. ## A price aligned with the outcome COP $0 if no high or critical findings are confirmed. Our launch offer aligns price with outcome: COP $0 if no high or critical vulnerabilities are confirmed within scope; COP $5M for one high finding; capped at COP $9M however many we find. The assessment always runs in full, with an executive and a technical report, and one retest included in paid engagements. ## And the human factor Controlled phishing and social engineering, from COP $5M. Technology exposes; people open. We run controlled phishing and social-engineering tests from COP $5 million, with a report and training for your team. With voice cloning and deepfakes this layer matters more every year: see our protocol against deepfake fraud. ### Key takeaways - Test the production web and APIs, not the demo. - Validate every finding by hand; the scanner is the floor. - Severity combines CVSS and business context. - The retest verifies the fixes and is included in paid assessments. - No high findings means the assessment costs COP $0. ## Sources - Latin America 2025 mid-year cyber snapshot · Check Point Research, 2025-07-10 - América Latina, la región más afectada por el ransomware · Kaspersky, 2026-05-12 - Internet Crime Report 2025 · FBI IC3, 2026-04 - OWASP API Security Top 10 (2023) · OWASP, 2023 - Web Security Testing Guide · OWASP - CVSS v4.0 Specification · FIRST, 2023-11-01 Editorial note: this analysis reflects the public information available on the review date. Models, prices and rules change fast; every third-party figure links to its source, and our opinions are labeled as such. Spotted an error? Write to contact@slash-digital.io. Frequently asked questions ## The questions we hear often **Is COP $0 real when nothing is found?** Yes: with no confirmed high or critical findings within scope, the assessment is free and you keep the full report. **Where does the statistic come from?** From CRC and FortiGuard Labs (prospective cybersecurity analysis, 2026). An attempt is not a successful attack. **Do you test mobile apps?** The offer covers web apps and APIs; other scopes are quoted separately. **Who fixes the findings?** Whoever you choose: your team, another vendor or Slash. The retest still applies. **Do you sign an NDA?** Yes: scope and confidentiality are signed before testing starts.