COP $0
If we find no confirmed high or critical vulnerabilities.
Launch offer · Colombia
Web & API penetration testing
At Slash Digital Lab (Bogotá, Colombia), the price of your pentest depends only on the high or critical vulnerabilities we find and validate within the agreed scope.
COP $0 no high findingsCOP $5M 1 high findingCOP $9M cap: 2 or more
Launch offer: price by findings
COP $5 M
If we identify 1 confirmed high or critical vulnerability.
COP $9 M
Maximum, however many high or critical vulnerabilities we find.
The assessment runs in full regardless of the number of findings.
The best moment to find a vulnerability is before it becomes an incident.
We run offensive assessments of web apps and APIs to find exploitable flaws, validate their real impact and prioritize what to fix first. We don't just hand over scanner output.
What the assessment includes
A real security assessment of web apps and APIs, with manual validation of the relevant findings.
- Web & API pentestManual plus automated testing to find what scanners miss.
- Executive & technical reportEvidence, impact, priority and remediation guidance.
- 1 retest included in paid assessmentsOnce fixes land, we verify again.
- Retest holds regardless of who fixesValid whether your team, another vendor or Slash ships the fix.
No high vulnerability found? You still get the report.
At no cost: medium, low and informational findings, with evidence and remediation guidance.
We can also help you fix it.
On request, Slash prepares an independent proposal to implement the recommended fixes.
And the human factor?
Controlled phishing and social-engineering tests from COP $5 million.
Cyberattacks in Colombia: the context
Colombia · 2025
471.5 M
attack attempts detected in the country during the year
1.3 Mper dayDid you know Colombia saw nearly 1.3 million attack attempts a day?
That equals 471.5 million attack attempts over the year. A vulnerability can stay invisible until someone exploits it.
Source: CRC / FortiGuard Labs, prospective cybersecurity analysis, 2026. “Attack attempts” does not equal successful attacks.
Severity
How “high” and “critical” are decided
The price depends on severity, so the rule has to be verifiable. Every finding is manually validated and must be reproducible; severity uses CVSS plus business context.
Reproducible evidence
Every high or critical finding ships with the steps to reproduce it, so your team can check it independently.
CVSS + business context
The industry-standard score, adjusted to the real impact on your operations and data.
Within the authorized scope
Anything that can't be reproduced within the scope agreed in the contract isn't reported as high or critical.
Talk to Slash
Which platform would you like to assess?
Tell us the domain, application or platform to review. We'll make a first read and confirm the scope.
Offer subject to scope definition and contract. High or critical findings must be confirmed and reproducible within the authorized scope.
Frequently asked questions
The questions we hear often
What if you find nothing?
You keep the full report with medium, low and informational findings, at no cost.
How is the price calculated?
COP $0 with no high findings; COP $5M for one; capped at COP $9M.
Do you test APIs?
Yes, together with the web: that's where the expensive doors open today.
Do you run simulated phishing?
Yes, from COP $5M, with a report and team training.
Who fixes the findings?
Whoever you choose: your team, another vendor or Slash; the retest still applies.
How do we start?
Send us the domain or platform; we do a first read and confirm scope in the contract.
Related capabilities
Where to next
Cyber
Cybersecurity
Offensive assessment, hardening and response: real security, no smoke.
Learn more→ CybersecurityPentest in Colombia: what to really test
Not a scanner PDF: web apps and APIs, manual validation of every finding and a retest, priced on the outcome.
Learn more→ CybersecurityHow AI changes pentesting
What attackers now do with AI, what Mythos, Big Sleep and XBOW find, why validation became the scarce skill and how to adapt your pentest in Colombia.
Learn more→ CybersecurityPrompt injection and agent security: risk number one
Why prompt injection is still unsolved, what the 2025–2026 incidents show and which controls actually work for agents and chatbots.
Learn more→