COP $0
If we find no confirmed high or critical vulnerabilities.
Launch offer · Colombia
Web & API penetration testing
At Slash Digital Lab (Bogotá, Colombia), the price of your pentest depends only on the high or critical vulnerabilities we find and validate within the agreed scope.
COP $0 no high findingsCOP $5M 1 high findingCOP $9M cap: 2 or more
Launch offer: price by findings
COP $5 M
If we identify 1 confirmed high or critical vulnerability.
COP $9 M
Maximum, however many high or critical vulnerabilities we find.
The assessment runs in full regardless of the number of findings.
The best moment to find a vulnerability is before it becomes an incident.
We run offensive assessments of web apps and APIs to find exploitable flaws, validate their real impact and prioritize what to fix first. We don't just hand over scanner output.
What the assessment includes
A real security assessment of web apps and APIs, with manual validation of the relevant findings.
- Web & API pentestManual plus automated testing to find what scanners miss.
- Executive & technical reportEvidence, impact, priority and remediation guidance.
- 1 retest included in paid assessmentsOnce fixes land, we verify again.
- Retest holds regardless of who fixesValid whether your team, another vendor or Slash ships the fix.
No high vulnerability found? You still get the report.
At no cost: medium, low and informational findings, with evidence and remediation guidance.
We can also help you fix it.
On request, Slash prepares an independent proposal to implement the recommended fixes.
And the human factor?
Controlled phishing and social-engineering tests from COP $5 million.
Cyberattacks in Colombia: the context
Colombia · 2025
471.5 M
attack attempts detected in the country during the year
1.3 Mper dayDid you know Colombia saw nearly 1.3 million attack attempts a day?
That equals 471.5 million attack attempts over the year. A vulnerability can stay invisible until someone exploits it.
Source: CRC / FortiGuard Labs, prospective cybersecurity analysis, 2026. “Attack attempts” does not equal successful attacks.
Severity
How “high” and “critical” are decided
The price depends on severity, so the rule has to be verifiable. Every finding is manually validated and must be reproducible; severity uses CVSS plus business context.
Reproducible evidence
Every high or critical finding ships with the steps to reproduce it, so your team can check it independently.
CVSS + business context
The industry-standard score, adjusted to the real impact on your operations and data.
Within the authorized scope
Anything that can't be reproduced within the scope agreed in the contract isn't reported as high or critical.
Talk to Slash
Which platform would you like to assess?
Tell us the domain, application or platform to review. We'll make a first read and confirm the scope.
Offer subject to scope definition and contract. High or critical findings must be confirmed and reproducible within the authorized scope.
Frequently asked questions
The questions we hear often
What if you find nothing?
You keep the full report with medium, low and informational findings, at no cost.
How is the price calculated?
COP $0 with no high findings; COP $5M for one; capped at COP $9M.
Do you test APIs?
Yes, together with the web: that's where the expensive doors open today.
Do you run simulated phishing?
Yes, from COP $5M, with a report and team training.
Who fixes the findings?
Whoever you choose: your team, another vendor or Slash; the retest still applies.
How do we start?
Send us the domain or platform; we do a first read and confirm scope in the contract.
Do you sign an NDA?
Yes: scope and confidentiality are signed before testing starts. We only assess the domains, apps and APIs in the signed document, and the offer is subject to that scope definition and the contract. Every finding comes with reproducible evidence in an executive and technical report.
What should we hand over for the test?
For the first read, the domain or platform. For the test, unless you have a reason to do otherwise, we recommend grey box: two accounts per role (and per customer if the platform is multi-tenant), the API documentation and the business context of each critical flow, such as payments, approvals or personal data.
Related capabilities
Where to next
Cyber
Cybersecurity
Offensive assessment, hardening and response: real security, no smoke.
Learn more→ CybersecurityWhat to test in a web and API pentest
Not a scanner PDF: web apps and APIs, manual validation of every finding and a retest, priced on the outcome.
Learn more→ CybersecurityDeepfake fraud: a protocol for companies
From Arup's $25.6M loss to FBI figures: how cloned-voice and deepfake fraud works, and a verification protocol for finance, HR and executive assistants.
Learn more→ SoftwareCustom software
We replace SaaS licenses with owned products your team controls.
Learn more→