Cybersecurity consulting: know where you stand and put your defenses to the test

With the Vortex Assessment, conducted by Vortex specialists to understand the business moment and the stage of cybersecurity maturity, based on NIST CSF 2.0. It delivers the gap map, a roadmap in waves of 3, 6 and 12 months, with owners and deadlines, and vendor-agnostic recommendations of the most suitable technologies and strategies.

Mainly two of the six. In Govern (GV): the program strategy and roadmap, policies, standards and procedures, compliance with the LGPD, PCI-DSS and ISO/IEC 27001, third-party risk and vCISO. In Identify (ID): Risk Assessment (ID.RA), with the Risk Assessment service, the OT assessment using ISA/IEC 62443-3-2 and the cloud and application assessments, and Improvement (ID.IM), with the Vortex Assessment, pentests, Red Team, Purple Team and tabletop exercises. The hardening review supports the Protect function, and the incident response retainer (DFIR) and business continuity (BCDR) belong to Respond and Recover, in the Detect and Respond phase of the Journey.

A pentest, or penetration test, is a test in which specialists, working under agreed rules and limits, attempt to circumvent or defeat the security controls of a system, as an attacker would (NIST). At Vortex, the pentest simulates real attacks on web applications and APIs, on infrastructure and networks and on mobile apps, to identify critical gaps and validate the effectiveness of existing controls.

The pentest simulates real attacks to identify critical gaps and validate the effectiveness of existing controls. The deliverables include objective reports, vulnerability prioritization and actionable recommendations, with technical and executive visibility.

Yes. The offensive security team holds certifications such as CEH, OSCP, eWPTX v2, DCPT and SCWAP and publishes its own vulnerability research: the team’s CVEs include CVE-2021-42192, in Konga, and three in SNMP Web Pro, management software for data center UPS units, from the independent research of the senior Red Team specialist, who is recognized in bug bounty programs such as those of Spotify (1st place in the 2025 Hall of Fame), Apple and NASA. Every penetration test has two specialists, one leading and one operating, and follows PTES, OWASP, NIST SP 800-115 and MITRE ATT&CK.

A pentest looks for the exploitable flaws in a system, under agreed rules and limits, and delivers the prioritized vulnerabilities. A Red Team simulates a real adversary, with defined objectives and MITRE ATT&CK techniques, to measure the organization’s ability to prevent, detect and respond to a targeted attack. A Purple Team brings the attack and defense teams together, technique by technique, to validate detections, tune rules and expand SOC coverage. The cybersecurity glossary (PT) has the definitions, with sources.

In addition to penetration testing of web applications and APIs, of infrastructure and networks and of mobile apps, Vortex runs Red Team and Purple Team exercises and has a dedicated team for phishing campaigns, social engineering and threat emulation.

For banks, credit unions and other institutions subject to Resolução CMN 4.893, from Brazil’s National Monetary Council, yes: since CMN 5.274, of December 2025, the penetration test must take place at least once a year, with independence and impartiality, by a specialized person or company hired for it, with the results and the remediation plans documented. Tests by the internal team can be done in addition, without replacing it (guide to Resoluções CMN 4.893 and BCB 85 (PT)). In other sectors, the obligation depends on each company’s regulations and contracts.

Yes. Vortex consulting includes compliance readiness for the LGPD (Brazil’s General Data Protection Law), PCI-DSS and ISO/IEC 27001, data protection impact assessments (DPIA) under the LGPD, development of policies, standards and procedures, and third-party risk management. Vortex itself is certified to ISO/IEC 27001, ISO/IEC 27701 and ISO 22301.

It is on-demand security leadership: a Vortex executive leads the cybersecurity program, governance and reporting to the board. In NIST CSF 2.0, this is the work of the Govern function, which sets the roles, responsibilities, policy and oversight of risk management.

Yes. Vortex consulting includes business continuity and disaster recovery, tabletop exercises for incident preparedness and an incident response and digital forensics (DFIR) retainer. The Vortex incident response team conducts in-depth analysis, containment, eradication and support for the recovery of the environment. The incident response plan guide (PT) shows what the plan needs to include.

Yes. The OT/ICS Risk Assessment applies the Cyber-PHA of ISA/IEC 62443-3-2: instead of listing the CVEs on the network, it measures what happens to the process if an automation function is compromised, with consequences for people, the environment, finances and reputation. It has five stages and two workshops, with the vulnerability scan as evidence, controls linked to ISA/IEC 62443-3-3 and a target architecture. See the water and sanitation case.

Yes. In the consulting catalog, the AI Security Assessment assesses governance and security in the use of AI, with alignment to references such as ISO/IEC 42001, NIST AI RMF and the LGPD. For the complete AI security and governance journey, from visibility to protection, Vortex has Vortex AI Journey, which starts with the AI Journey Assessment. The ISO/IEC 42001 guide (PT) explains the standard.

Yes. When complexity calls for something beyond the conventional, Vortex works through special cybersecurity projects, designed for the particularities of each business.