Talk to a specialist

Cybersecurity consulting and digital forensics · Panama

Cybersecurity, tested. Risk, demonstrated.

Penetration testing, audits, compliance, incident response and digital forensics for organizations where evidence and continuity matter.

Talk to a specialistSee how we work

Is there an incident in progress?

  1. Email initial signal
  2. People compromise
  3. Identity credentials / access
  4. Critical data movement towards sensitive information

The attack got this far.

Defense that stops the attack. Filtering and awareness: Email → People leg blocked.

  1. Email Headers, mailbox rules and messages
  2. People Device artifacts
  3. Identity Authentication logs
  4. Critical data Access logs

We can reconstruct what happened. Timeline and chain of custody.

Critical data

What really has to be protected: customer, operational and internal information.

Email

The most used way in for deception and account theft.

People

The people who receive emails, open links and handle data every day.

Identity

Accounts, passwords, multi-factor authentication and the directory. One privilege too many opens many doors.

Sites and APIs

Everything your organization exposes to the internet that anyone can probe.

Cloud

Cloud services with their own configuration, permissions and shared-responsibility model.

Applications

The business systems that process the data and show it to whoever has access.

Remote access

VPNs, remote desktops and connections from outside the office.

Endpoints

Laptops and servers where malware runs and where the evidence stays.

Backups

The last line: copies that can be restored when everything else fails.

Vendors

Third parties with access to your systems or your data.

Network

Segmentation, firewalls and access between zones.

Logs

What every system writes down. Without logs there is no way to reconstruct what happened.

Illustrative simulation, not a real client

  • Offensive + DefensiveSenior knowledge since 2019
  • ForensicsDigital forensic examiner

Regulated sectors

  • Banking
  • Government
  • Healthcare
  • Aviation
  • Legal

Clear, practical, results-oriented solutions

See all services

Explore your attack surface before the assessment

Three illustrative simulations, in your browser and with no data: which assessment fits what you use, how likelihood and impact combine and how an incident unfolds.

Illustrative simulationIt runs in your browser. We ask for no data and send nothing.
What does your organization use today?

Tick everything that applies.

Tick one or more areas and the surface that opens up, and the assessments that cover it, appear here.

Open the full simulator

This simulation needs JavaScript to calculate. Without it, see how areas relate to services further down.

Illustrative simulation

5×5 risk matrix

Combine likelihood and impact across five scenarios and see whether it usually pays to accept, mitigate, transfer or avoid.

Open the matrix
Illustrative simulation

An incident, moment by moment

Walk through an illustrative incident, from an email to the data, and see what is contained, what evidence exists and what the team does.

  1. 00:00Initial access by email
  2. 00:27Compromised credential
  3. 01:40Privilege escalation
  4. 03:15Data access
Walk through the incident

One route. Three lenses.

Every point on the route reads three ways: what it opens for an attacker, which defense cuts it and what evidence it leaves.

A deceptive email reaches a person, their account signs in and reads the data.

See penetration testing

Each control cuts one of the routes the attacker needs.

See compliance and controls

Every step leaves traces, and we preserve them in order to reconstruct what happened.

See digital forensics

  1. A deceptive email arrives

    Headers, mailbox rules and messages

  2. Control: Filtering and awareness

    Credentials are captured

    Device artifacts

  3. Control: MFA

    The account signs in

    Authentication logs

  4. Control: Segmentation and hardening

    The critical data is read

    Access logs

Select a point on the route to see its detail.

Timeline and chain of custody

Email

The most used way in for deception and account theft.

People

The people who receive emails, open links and handle data every day.

Identity

Accounts, passwords, multi-factor authentication and the directory. One privilege too many opens many doors.

Critical data

What really has to be protected: customer, operational and internal information.

How we work: from diagnosis to validation

A measurable, documented process aligned to risk.

  1. Diagnosis

    We define the scope, the critical assets and the goals with you, and measure the starting point.

  2. Execution

    We carry out the audit, the tests or the intervention under agreed rules, with evidence at every step.

  3. Reporting

    We deliver findings with technical evidence and a remediation plan prioritized by risk, in language that both leadership and the technical team understand.

  4. Validation (retest)

    Once you have fixed the findings, we test again to confirm the improvement is real.

Security in motion

From exposure to evidence

The whole journey in eighteen seconds: what is exposed, the attack that is validated, the incident that is investigated and the evidence that remains.

  1. ExposureWe map exposed assets, email, identity, services and nodes.
  2. Attack and validationA route advances in a controlled test and a control stops it.
  3. IncidentLogs, timeline, events and artifacts tell what happened.
  4. EvidenceWe preserve, correlate and keep the chain of custody.
  5. ResultReport, prioritized risk, remediation and retest.
  6. SoluProTecAttack. Defense. Evidence.
Illustrative 18-second sequence, with no sound. It shows no client and no measured result.

Case studies

Four of the twelve experiences consolidated from real engagements, told without identifying the clients.

See all 12 experiences
  • Consolidated experience 01

    Multi-sectorPentesting

    Internal security and corporate identity

    Problem
    Weaknesses in configuration, services and identity could make unauthorized access easier inside the organizations assessed.
    Results
    • Privileged access paths validated in controlled tests.
    • Weaknesses and effective controls documented by scope.
    • Technical priorities based on the impact observed.

    Identities withheld

  • Consolidated experience 02

    Multi-sectorPentesting

    External exposure, web applications and digital risks

    Problem
    Applications, public services and information exposure called for a technical review to identify risks and guide fixes.
    Results
    • Findings prioritized by application and asset.
    • Information and component exposures identified.
    • Recommendations specific to the risk observed.

    Identities withheld

  • Consolidated experience 10

    Multi-sectorForensics

    Incident investigation and ransomware response

    Problem
    Intrusion and encryption incidents called for reconstructing access, understanding how the attack spread and guiding response actions.
    Results
    • Timelines of access and propagation documented.
    • Findings on impact and exposed controls.
    • Containment and hardening recommendations.

    Identities withheld

  • Consolidated experience 11

    Multi-sectorForensics

    Expert examination of digital evidence and specialized forensic analysis

    Problem
    Suspicions, fraud and disputes needed to be clarified through evidence from email, documents, software or devices.
    Results
    • Timelines and traceability of digital evidence.
    • Assessment of integrity, authenticity and consistency.
    • Technical conclusions with the limits of the evidence stated expressly.

    Identities withheld

Consolidated experience 01

PentestingMulti-sector

Internal security and corporate identity

Sectors served

  • Banking
  • Government
  • Aviation
  • Legal
  • Private sector

Services offered / delivered

  • Internal penetration testing
  • Active Directory and AD CS assessment
  • Analysis of privileges and internal services

Context

This experience brings together internal assessments of corporate networks and identity services. Scope, controls and results varied between organizations.

Documented interventions

  • Review of internal services, authentication, privileges and configuration.
  • Controlled validation of access chains across identity services where the scope allowed it.
  • Documentation of successful tests, blocked attempts and mitigation recommendations.

Documented results

  • In some engagements, paths to critical privileges were demonstrated; in others, controls were observed that blocked techniques that had been tested.
  • The reports separated identified vulnerabilities from proven exploitation and made it possible to prioritize risk treatment.

Scope of the result

The results belong to the scope of each assessment. We do not claim that every organization or system was compromised, nor any later remediation where there is no revalidation.

Methodology

Controlled penetration testing, identity review and correlation of technical evidence.

Identities withheld

Consolidated experience 02

PentestingMulti-sector

External exposure, web applications and digital risks

Sectors served

  • Banking
  • Government
  • Aviation
  • Legal
  • Private sector

Services offered / delivered

  • External and web/API penetration testing
  • Black-box and gray-box assessments
  • OSINT and digital exposure intelligence

Context

This experience consolidates work on public-facing surfaces and applications, together with digital exposure investigations. Each engagement kept its own scope and methodology.

Documented interventions

  • Assessment of authentication, sessions, configuration and controls in web/API applications.
  • Review of published services, components, certificates and administrative surfaces.
  • In intelligence work, identification of public assets and of exposed identities or information.

Documented results

  • Findings and recommendations were delivered separately for each application, service or exposure investigated.
  • Some surfaces produced no findings in their tests. That result was not extended to other assets or to the organization as a whole.

Scope of the result

Exposure in external sources does not prove valid credentials, active sessions or an intrusion. A client's reply about fixes is not the same as an independent retest.

Methodology

Controlled testing of applications and services; research in external sources for the intelligence work.

Identities withheld

Consolidated experience 10

ForensicsMulti-sector

Incident investigation and ransomware response

Sectors served

  • Legal
  • Private sector

Services offered / delivered

  • Incident response and infrastructure forensic analysis
  • Ransomware and lateral movement investigation
  • Correlation of logs and indicators

Context

This group brings together investigations of affected infrastructure and response support, with the evidence and limits specific to each incident.

Documented interventions

  • Analysis of logs, account activity, connections and tools associated with the incident.
  • Construction of timelines and cross-checking across systems, sources and indicators.
  • Documentation of impact and recommendations for containment, recovery and improved controls.

Documented results

  • Traceability of access, propagation and control exposure was provided in the cases investigated.
  • The reports distinguished documented facts, indications and recommendations for the response.

Scope of the result

We do not claim full recovery, restoration times or losses avoided without evidence. Attributions of ransomware family or authorship that are inconsistent or inconclusive are left out.

Methodology

Forensic analysis of logs and artifacts, temporal correlation and documentation of evidence.

Identities withheld

Consolidated experience 11

ForensicsMulti-sector

Expert examination of digital evidence and specialized forensic analysis

Sectors served

  • Banking
  • Aviation
  • Legal
  • Private sector
  • Individuals

Services offered / delivered

  • Email forensics and fraud analysis
  • Document and image authentication
  • Expert software examination
  • Forensics of computers, storage and mobile devices

Context

This experience consolidates independent expert examinations and investigations. The file represents experience by specialty, not a single dispute or person.

Documented interventions

  • Email and documents: reconstruction of communications and cross-checking of headers, dates, attachments and metadata.
  • Software: review of repositories, change requests, contracts and infrastructure as sources of traceability.
  • Computers, storage and devices: review of artifacts, logs and available evidence; assessment of the feasibility of mobile recovery in the specific engagements.

Documented results

  • The reports provided timelines and elements of traceability, integrity or authenticity for the evidence examined.
  • Some mobile reviews did not identify conclusive indicators of compromise. A recovery assessment that did not manage to recover the data was documented as a technical limitation.

Scope of the result

An expert conclusion does not imply a favorable ruling or acceptance by the court. We do not claim authorship of the fraud, a universal absence of spyware, a complete physical extraction or a successful recovery beyond what is documented.

Methodology

Preservation and analysis of artifacts, integrity checks and cross-checking of metadata and documentary sources.

Identities withheld

Certifications, forensic and expert-witness capability

Offensive, defensive, governance, forensic and cloud credentials stand behind every service, and forensic and expert-witness capability supports the cases that need evidence.

54 certifications · 18 international bodies

See all credentials
  • OSCP
  • OSEP
  • OSWE
  • CISSP
  • CISM
  • CISA
  • LPT
  • CEH
  • CHFI

Forensic and expert-witness capability

See the digital forensics service
  • Chain of custody and evidence preservation
  • Reproducible, verifiable method
  • Technical expert report and executive summary

Professionally licensed engineers registered with Panama's Technical Board of Engineering and Architecture (JTIA)

JTIA professional licensing applies to qualified engineers on the team and should not be interpreted as a cybersecurity certification or a certification of SoluProTec.

Frequently asked questions

See all questions
Which cybersecurity services does SoluProTec offer?

Eight services: audits and risk assessment, compliance and security policies, penetration testing and vulnerability analysis, incident response and ransomware, awareness and training, strategic consulting, digital forensics and expert witness services, and Cyber Recovery.

What is the difference between an audit, a vulnerability analysis and a penetration test?

An audit reviews controls and processes against a reference framework. A vulnerability analysis detects and prioritizes known technical weaknesses. A penetration test chains them and exploits them in a controlled way to show real impact. They are combined according to the goal.

What should I do if I already have an incident under way?

Disconnect the affected machines from the network, keep everything you see and contact us before shutting down, wiping or reinstalling. When you write to us, choose the option “There is an incident in progress”: the form goes straight to your contact details.

What is a digital forensic expert report and when is it needed?

It is a technical investigation of facts in digital systems, documented with traceable evidence in a report that others can review. It is needed when you have to establish what happened in an incident, in an internal investigation or in a dispute, and the facts must be supported by evidence.

Can you help me comply with ISO 27001, NIST, PCI DSS or GDPR?

Yes. We run the gap analysis, design policies and controls, guide the implementation and carry out the internal audit. ISO 27001 certification is issued by an accredited certification body, not by us.

How do I get started?

Use “Talk to a specialist” and tell us what you need, how urgent it is and how to reach you. A SoluProTec specialist reviews your request and contacts you through the channel you provide.

Tell us what you need to protect

A SoluProTec specialist reviews your request and contacts you through the channel you provide.

Talk to a specialistIs there an incident in progress?