Elite ethical hacking by certified offensive squads. We exploit your environment like a real adversary, chain findings up to business impact and confirm every fix with a retest.
Manual exploitation by OSCP, OSWE and CRTO operators · Operating in Brazil, Chile and the US
Both start with a list of targets. Only one ends with the certainty that the risk is gone.
We use scanners too. They give us coverage. The value is in what comes after: the people who chain findings, bypass controls and reproduce how breaches actually happen.
Low-risk findings, chained together, are how real breaches happen. That is what we test.
Definition
Ethical hacking is the authorized simulation of a real attack against an organization’s systems, applications and people. Certified operators exploit vulnerabilities manually, chain them into realistic attack paths and measure the business impact, so the organization can fix what matters before an adversary finds it.
It goes beyond a vulnerability scan or a checklist pentest: the result is proof of what an attacker could reach, not a list of possibilities.
| Market pentest | Mercurius ethical hacking | |
|---|---|---|
| Execution | Automated scan with a quick manual check | Manual exploitation by certified operators |
| Depth | Isolated findings | Low-risk findings chained into a real path to your critical assets |
| Team | Generalist testers | A dedicated squad per specialty, with built-in backup |
| Report | A list of vulnerabilities | CVSS 4.0, OWASP, MITRE ATT&CK, CWE and business impact |
| Audience | The IT team | Engineers, CISO and board, each with their own report |
| After the report | Project closed | Retest, debrief and remediation follow-up |
| Cadence | A yearly snapshot | Continuous testing with PTaaS, at every release |
Six certified analysts organized by attack surface. Each one leads a specialty and backs up another, so no engagement depends on a single person.
Cloud pentest, IAM and workloads
API squad
Web AppSec and advanced exploitation
AI / LLM squad
APIs and system integrations
Cloud squad
LLMs, agents and chatbots
Web Apps squad
Network, Active Directory and red team
Purple Team
Track record in Hack The Box Pro Labs (Offshore, APTLabs, RastaLabs, Dante, Zephyr), managed bug bounty with Synack Red Team and Yogosha, and CTF competitions.
Objective-driven, stealthy operations that emulate a real threat actor end to end. We test whether your team detects and responds before a business objective is reached, including OT/ICS environments, without stopping production.
When you need to measure resilience, not just exposure
Internal and external testing of networks and infrastructure with the manual depth scanners miss. Every finding comes with proof of exploitation and remediation steps your engineers can act on.
When you need audit-ready evidence for PCI DSS, ISO 27001, SOC 2 or LGPD
Web apps, mobile apps and APIs tested for business-logic flaws, authentication and authorization gaps. We also review the code that automated tools cannot reason about.
When you ship software every week and can’t ship breaches
We find and exploit misconfigurations and excessive privilege: the IAM, exposure and lateral-movement paths that turn one weak setting into full compromise.
When your perimeter is now your cloud configuration
Offensive testing of LLMs, copilots and agents against prompt injection, jailbreaks and data leakage, led by a dedicated AI / LLM squad.
When AI already talks to your customers or your data
Recurring tests aligned with your release cycle. Findings arrive as they are validated, not in a PDF months later.
When a yearly snapshot no longer matches how fast you change
Every engagement follows a defined, low-risk process agreed with your team before a single packet is sent.
Targets, objectives, allowed techniques, escalation contacts and safe windows, agreed in writing.
We map the real attack surface: the assets, identities and entry points an adversary would find first.
We exploit and chain findings to prove impact, with a live activity log and a defined stop procedure.
Executive and technical reports, every finding rated by impact and mapped to your frameworks.
We come back after the fix, confirm the path is closed and debrief your team live.
Executive report
Risk in business language: financial, operational, reputational and regulatory impact, ready for the board and cyber-insurance review.
Technical report
CVSS 4.0, OWASP Top 10, MITRE ATT&CK and CWE for every finding, with evidence and reproduction steps.
Prioritized remediation
What to fix first, ranked by exploitability and business impact.
Compliance mapping
Findings aligned to PCI DSS, ISO 27001, SOC 2, LGPD and GDPR.
Retest & debrief
Validation that fixes hold, plus evidence for your auditors.
Because we also run exposure management and a 24/7 SOC, what we exploit today becomes what we prioritize and monitor tomorrow.
Our squads prove which findings an attacker can actually use.
Each technique we used becomes a detection rule in our SOC AI, operated 24/7.
See SOC AI 24/7
Validated findings go to the top of your remediation queue, with patch tracking.
See Exposure Management
Many pentests stop at a list of vulnerabilities, often from automated tools. Our ethical hacking engagements are led by certified operators who exploit and chain those vulnerabilities to prove what an attacker could reach, translate it into business impact and retest after the fix.
A penetration test is a scoped, time-boxed assessment that finds and exploits as many vulnerabilities as possible in a defined target. A Red Team engagement is objective-driven: it tests whether your detection and response can stop a determined attacker from reaching a specific business outcome. Pentests measure exposure. Red Teams measure resilience.
Every engagement starts with a formal scoping and rules-of-engagement agreement: targets, allowed techniques, escalation contacts and safe windows. Our operators follow OSSTMM and OWASP methodologies, keep a live activity log and have a defined stop procedure. In OT/ICS environments we work without stopping production.
Yes. We retest the findings after your team applies the fixes, confirm the attack path is closed and deliver the evidence for your auditors.
Yes. Independent penetration testing is an explicit PCI DSS control, supports the technical-measures requirements of LGPD and GDPR, and provides audit evidence for ISO 27001 and SOC 2. Every finding is mapped to the relevant framework.
We use scanners for coverage, but every engagement is driven by experienced operators who chain findings, bypass controls and reproduce real attacker behavior. You receive validated, exploitable findings with proof of impact, not a scanner export full of false positives.
We are offensive-led by design, operating in Brazil, Chile and the United States with delivery in Portuguese, Spanish and English. Our leadership includes a former Latin America CISO at one of the region’s largest banks, so engagements are run by people who understand regulators and boards across the region.
Tell us your environment and objective. We come back with a scoping proposal and the engagement we recommend. No obligation.