Cybersecurity for institutions where trust is the asset

The main ones are Brazil’s LGPD (General Data Protection Law), the resolutions of the Central Bank of Brazil (BACEN) and the rules of the National Monetary Council (CMN), the security requirements for payment institutions and for Open Finance, PCI DSS for card environments and ISO/IEC 27001. Beyond technological protection, institutions need to demonstrate governance, risk management, business continuity and internal controls.

Targeted social engineering, phishing and Business Email Compromise (BEC), attacks on third parties and critical suppliers and exploitation of vulnerabilities in web applications and APIs, as a point of entry for lateral movement to the transactional systems. With the pressure for 24x7 availability, extortion is particularly critical: a shutdown can affect thousands, or millions, of customers at the same time.

By mapping transactional systems, APIs and integrations with fintechs, protecting open integrations, monitoring calls, using strong authentication and mitigating API attacks. In practice, this includes API discovery and inventory, OWASP API Security Top 10 testing, rate limiting and runtime protection against attacks such as BOLA, BFLA and Mass Assignment, as well as penetration testing of web applications and APIs.

With behavioral analytics (UEBA), one of the detection layers of the Cyber Defense Center, the Vortex Converged NG-SOC (NG-SOC Convergente). The platform builds baselines of the normal behavior of users, devices and services and flags deviations such as atypical access, lateral movement, anomalous use of credentials, data exfiltration and abuse of privileged accounts. It is especially effective against insider threats and attacks with legitimate credentials, scenarios in which controls based solely on signatures or rules are blind.

Inside the environment, the behavioral analytics (UEBA) of the Cyber Defense Center flags anomalous use of credentials and abuse of privileged accounts. Outside it, the Threat Intelligence of Vortex Cockpit monitors leaked credentials, fake websites, profiles and apps, secrets exposed in public repositories and fraud offers against the brand, with a takedown queue.

From the outside, without touching the supplier. In Vortex Cockpit, each critical supplier receives a grade from A to E calculated only from public sources and DNS, based on what can be seen from the outside, such as email, certificates, services and leaks. Vortex also offers Third-Party Risk Management consulting.

Vortex Cockpit has views for the Board and the CEO, with adherence to the approved risk appetite and the decisions that depend on senior management, and for the CISO and GRC, with remediation deadlines, accepted risks, compliance and audits. The Vortex Score measures posture by the functions of NIST CSF 2.0, with the rigor audits require. Vortex service management completes this with an executive presentation, monthly reports on vulnerabilities, compliance, detection and response and SLA, and an incident report with the root cause.

The Cyber Defense Center operates from two active centers of equal size, in Rio de Janeiro and São Paulo, with no primary and contingency site: if one fails, the other takes over the entire operation. The infrastructure is replicated in data centers in Brazil and the US, with redundant internet links. Vortex is also ISO 22301 certified, for business continuity.

Vortex is certified to ISO/IEC 27001 and ISO/IEC 27701, for information security and privacy, which cover its own processes and the handling of client information, and to ISO 22301, for business continuity. It is also a Leader in the ISG Provider Lens 2026 for Next-Gen SOC/MDR Services (Midmarket) in Brazil.

Yes. Banco Arbi, IRB(Re), Petros and Austral are among the financial institutions that trust Vortex. Vortex protects the sector with the Cyber Defense Center, the NG-SOC Convergente, with 24x7x365 detection and response from two active centers, in Rio de Janeiro and São Paulo. It is a Leader in the ISG Provider Lens 2026 for Next-Gen SOC/MDR Services (Midmarket) in Brazil.