PEN-W · SECURITY
Web application pentesting
Black, grey and white box assessments of your web applications. Authenticated flows, business logic, session management, and IDOR class vulnerabilities.
OWASP Top 10ASVS L2Logic flaws
Independent · Vendor‑neutral · Since 2019
Clean, safe and scalable architectures.
We don't ship your code. We make sure no one breaks it. Mondtic is an advisory practice for teams that need to prove their systems are secure, sound, and ready for the next level.
20+
Engagements delivered
0
Lines of your code we wrote
100%
Vendor independent
< 24h
NDA turnaround
01 / Security Lens
Under attack? We think like attackers first
Offensive security as a service. We simulate real-world adversaries across your apps, APIs, and mobile applications, then deliver remediation plans your engineers can ship the same week.
- PEN-W Web application pentesting (white/grey/black box)
- PEN-M Mobile pentesting (iOS & Android, MASVS aligned)
- PEN-A API security review (REST, GraphQL, gRPC)
- REV-C Source-assisted code & secrets review
02 / Scale Lens
Thinking big? We've stress-tested bigger.
Architecture and scale advisory for platforms that must not collapse under growth. We sit next to your engineers in design reviews and deliver a written plan to take you from current to N×.
- ARC-R Architecture & well-architected review
- LOAD Load testing & capacity planning
- DATA Data layer & sharding strategy
- COST Cloud cost & efficiency audit
03 — Services
Eight engagements. Two lenses.
→ Don't see your scenario? We scope custom engagements in 72 hours.
PEN-W, PEN-M, PEN-A and REV-C produce the technical evidence typically requested in SOC 2, ISO 27001 and PCI-DSS audits.
04 — How we work
A 4‑step engagement, for teams building production-critical systems.
01
Scope
45-minute call. We align on objectives, depth, and success criteria. NDA signed the same day if required.
02
Engage
Small, senior-led teams. Every engagement is led by a partner with a verifiable production record in that lens. No outsourcing.
03
Report
Two deliverables: an executive summary for leadership, and a technical report your engineers can act on immediately.
04
Verify
Free re-test on every finding within 90 days. We don’t close the engagement until all critical issues are verified as resolved in production.
05 — Engagement models
Three ways to engage. Built for teams running production-critical systems.
All engagements are scoped in writing. No outsourced delivery, no junior-hour billing, and no vendor commissions.
Flexible access to senior engineers.
Vector
Direct access to senior security and platform engineers. Hours can be used across any engagement in our catalog.
Minimum 30-hour allocation
- Rate decreases as committed hours increase
- Valid for 6 months
- Shared async workspace + scheduled sessions
- Monthly consumption report
- 30-minute minimum per logged session
- Usable across security and scale engagements
Ongoing security and scale advisory. Recommended
Orbit
Continuous advisory across your security posture, architecture, and production systems.
25-hours month
- 25 / 60 / 120 hours per month, allocated by priority
- Monthly architecture review session
- Monthly executive reporting
- Quarterly rotating security assessment
- Direct Slack or Teams access
- Up to 20% hour rollover
- Quarterly business review
Defined scope. Defined outcomes.
Atlas
Every engagement begins with a no-cost discovery call and technical scoping session. We return a formal proposal with methodology, scope, timeline, and assigned consultants.
After scoping
- Fixed scope and written deliverables
- Dedicated senior-led team
- Capacity & cost planning
- Security or scale focus - or both
- Retest and verification included
- Timeline and methodology defined upfront
→ Custom scopes available for regulated industries.
06 — Who we are
We don’t build your code. We make it harder to break.
Mondtic is an independent advisory practice. We are pentesters, security engineers and platform architects with operator experience, meaning we’ve operated the systems we now review. We carry no commission, resell no tools, and keep our team small on purpose.
That independence is the product. Our reports are written for the engineers who will fix the bugs, and signed by the consultant who found them.
See how we work →Founded
2019
HQ
Cali · COL
Avg. experience
8 yr in production systems
Re-tests included
90 days
Vendor independence
100%
NDA turnaround
< 24h
Manifesto"A clean architecture is one where the next breach and the next 10× of growth are both boring problems."
07 — Partners
Two lenses. One partner accountable for each.
Three partners. Two on the security lens, one on scale.
Santiago Duque Martínez
Partner · Security lens
Pentester focused on web, API and mobile applications, with over six years in the field. Ranked number one in Colombia and Top 100 worldwide on HackerOne (Q2 2026), and part of Colombia's team at the HackerOne 2026 world event. Co-founder of the AnyWay Security community.
Andrés Albeiro Orozco Noreña
Partner · Security lens
Over eight years of penetration testing across infrastructure, web and mobile applications, APIs, OT environments, WiFi networks and social engineering. MSc in Cybersecurity, IMMUNE Technology Institute (Spain). Certified internal auditor for ISO 27001 and ISO 22301. Speaker at DragonJAR Security Conference, EkoParty UniTalks, 8.8 Perú, OWASP Panamá and KavaCON. Co-founder of the AnyWay Security community.
Alejandro Cárdenas
Partner · Scale lens
Platform architect with over nine years building and operating production systems: infrastructure as code with Terraform and Ansible across AWS, Azure and OpenStack, for platforms sustaining more than 100,000 concurrent users. Has led engineering teams, designed multi-tenant architectures, and implemented observability and incident response over production infrastructure. Covers all four lines of the scale lens: architecture review, load testing and capacity, data layer, and cloud cost efficiency.
A core of three partners. Every engagement is led and signed by one of us. When scope requires it, we bring in specialists from a vetted network: direct contract, our own NDA, never agency subcontracting. You know every name before you sign.
08 — Engagements
Trusted by teams that don't get to fail.
Anonymized engagements under strict NDAs. The cases below are real work, with identifying details removed.
Edtech / LMS
Security + Scale A learning platform operator running paid courses and officially recognized certification exams. Certificates carry legal weight; exam windows are set by the issuing authority and do not move.
Findings
- The course purchase flow could be manipulated to unlock paid content without a valid transaction.
- Student certificates could be duplicated and forged: identifiers were predictable and verification did not bind the document to a cryptographic signature.
- Authentication flaws in the login flow allowed account takeover (ATO).
Outcome
- The client rebuilt purchase and enrollment logic server-side, and moved certificate issuance to signed, non-guessable identifiers with a public verification endpoint.
PEN-WPEN-ALOAD
Fintech
Security Pre-launch review of a fintech platform whose core promise is custody of client funds. Fixed launch date, with no post-launch window for structural change.
Findings
31 findings across five vulnerability classes, before a single real user touched the system. Among them:
- Concurrent balance operations could read a stale balance, allowing the same funds to be spent more than once.
- Object-level authorization was missing across card management: an account could act on cards it did not own, including redirecting delivery of a physical card.
- Account takeover was reachable through several independent paths, from unthrottled authentication endpoints to verification steps that could be bypassed outright.
- Critical financial calculations ran on hardcoded sample values, and responses from external providers were consumed without sanity validation.
Outcome
- Every finding was delivered with a remediation path and re-verified after the client's fix. The platform went live on its original date, and we were retained as its security provider through its first three months in production. At retest, all findings were confirmed resolved.
PEN-WPEN-MPEN-AREV-C
E-commerce
Scale An online store inherited from a third-party implementer: infrastructure oversized to compensate for design decisions nobody on the internal team could explain, and a platform left unpatched because updating was manual and risky.
Findings
- Infrastructure provisioned against fear of peak load rather than measured load.
- A trail of platform and dependency versions with known vulnerabilities, unpatched because the update path was manual.
- Implementation patterns from the original vendor that turned every new feature into a source of regressions.
Outcome
- Infrastructure cost reduced by more than 60%, with concurrency and response times held at or above the previous baseline.
- Update and security-patch pipeline automated: patching went from a decision to a routine.
- Internal team trained on the review standards they now apply to their own features.
ARC-RLOADCOST
"They found in two weeks what our internal team had missed for a year."
"Senior people from day one. No bait and then switch."
09 — Contact
Tell us where it hurts. We respond the same day.
We read every message ourselves. NDA can be issued same day if required, with scoping calls scheduled within 72 hours.
Emailcontact@mondtic.com
WhatsApp(+57) 317 13 73 483