S01 · SECURITY
Web application pentesting
Black, grey and white box assessments of your web applications. Authenticated flows, business logic, session management, and IDOR class vulnerabilities.
OWASP Top 10ASVS L2Logic flaws
Independent · Vendor‑neutral · Since 2019
Clean, safe and scalable architectures.
We don't ship your code. We make sure no one breaks it. Mondtic is an advisory practice for teams that need to prove their systems are secure, sound, and ready for the next level.
30+
Engagements delivered
5
Industries served
0
Lines of your code we wrote
100%
Vendor independent
01 / Security Lens
Under attack? We think like attackers first
Offensive security as a service. We simulate real-world adversaries across your apps, APIs, and mobile applications, then deliver remediation plans your engineers can ship the same week.
- PEN‑W Web application pentesting (white/grey/black box)
- PEN‑M Mobile pentesting (iOS & Android, MASVS aligned)
- PEN‑A API security review (REST, GraphQL, gRPC)
02 / Scale Lens
Thinking big? We've stress‑tested bigger.
Architecture and scale advisory for platforms that must not collapse under growth. We sit next to your engineers in design reviews and deliver a written plan to take you from current to N×.
- ARC‑R Architecture & well‑architected review
- LOAD Load testing & capacity planning
- DATA Data layer & sharding strategy
- COST Cloud cost & efficiency audit
- REV-C Source‑assisted code & secrets review
03 — Services
Eight engagements. Two lenses.
→ Don't see your scenario? We scope custom engagements in 72 hours.
04 — How we work
A 4‑step engagement, for teams building production-critical systems.
01
Scope
45-minute call. We align on objectives, depth, and success criteria. NDA signed the same day if required.
02
Engage
Small, senior-led teams. Every consultant is certified, hands-on, and production-experienced. No outsourcing.
03
Report
Two deliverables: an executive summary for leadership, and a technical report your engineers can act on immediately.
04
Verify
Free re-test on every finding within 90 days. We don’t close the engagement until all critical issues are verified as resolved in production.
05 — Engagement models
Three ways to engage. Built for teams running production-critical systems.
All engagements are scoped in writing. No outsourced delivery, no junior-hour billing, and no vendor commissions.
Flexible access to senior engineers.
Vector
Direct access to senior security and platform engineers. Hours can be used across any engagement in our catalog (S01–S08).
$ ~120 / Minimum 30-hour allocation
- 30h at $120/h · 80h at $110/h · 160h at $100/h
- Valid for 6 months
- Shared async workspace + scheduled sessions
- Monthly consumption report
- 30-minute minimum per logged session
- Usable across security and scale engagements
Ongoing security and scale advisory. Recommended
Orbit
Continuous advisory across your security posture, architecture, and production systems.
$ From 2.5k / 25-hours month
- 25 / 60 / 120 hours per month, allocated by priority
- Monthly architecture review session
- Monthly executive reporting
- Quarterly rotating security assessment
- Direct Slack or Teams access
- Up to 20% hour rollover
- Quarterly business review
Defined scope. Defined outcomes.
Atlas
Every engagement begins with a no-cost discovery call and technical scoping session. We return a formal proposal with methodology, scope, timeline, and assigned consultants.
$ From 4.5k / After scoping
- Fixed scope and written deliverables
- Dedicated senior-led team
- Capacity & cost planning
- Security or scale focus - or both
- Retest and verification included
- Timeline and methodology defined upfront
→ Pricing in USD · VAT excluded · Custom scopes available for regulated industries.
06 — Who we are
We don’t build your code. We make it harder to break.
Mondtic is an independent advisory practice. We are pentesters, security engineers and platform architects with operator experience, meaning we’ve operated the systems we now review. We carry no commission, resell no tools, and keep our team small on purpose.
That independence is the product. Our reports are written for the engineers who will fix the bugs, and signed by the consultant who found them.
View engagement methodology →Founded
2019
HQ
Cali · COL
Avg. experience
9 yr in production systems
Re‑tests included
Always
Vendor independence
100%
NDA turnaround
< 24h
Manifesto"A clean architecture is one where the next breach and the next 10× of growth are both boring problems."
07 — Engagements
Trusted by teams that don't get to fail.
Anonymized engagements under strict NDAs. The examples below represent sectors and system scale we’ve worked with.
"They found in two weeks what our internal team had missed for a year."
"Senior people from day one. No bait and then switch."
08 — Contact
Tell us where it hurts. We respond the same day.
We read every message ourselves. NDA can be issued same day if required, with scoping calls scheduled within 72 hours.
Emailcontact@mondtic.com
WhatsApp(+57) 300 665 64 35