Fake emails and CEO fraud
One email that looks like a supplier or an executive is enough to change a bank account or steal a password.
Audit · Pentest · Awareness
We find where your company is exposed before an attacker does
We audit your cybersecurity in phases, with signed authorization and without disrupting operations. You get a report leadership understands and a prioritized plan with cost, effort and owner.
- NDA and authorization letter before we start
- Evidence encrypted and destroyed after 90 days
- Critical issues reported within 24 h
The real risk
What is happening today to companies like yours
Most incidents in mid-sized companies don't need a sophisticated attacker: they exploit what nobody checked.
Ransomware with untested backups
If backups have never been restored, you don't know whether they will save you the day you need them.
Personal data and LFPDPPP
Records, payroll and customer databases carry legal obligations; a leak is paid for in fines and reputation.
Clients and insurers ask for evidence
More and more contracts and policies require proof of security controls, not just a claim that they exist.
Services
From assessment to continuous improvement
The audit is the starting point; afterwards we help you close what we found.
Cybersecurity audit
A complete assessment of your posture with CIS Controls and NIST CSF 2.0.
- Interviews with leadership and IT
- External and internal scanning
- Cloud, identity, network and backup review
- Executive report and technical annex
Penetration testing
A controlled attack on what matters most to you, always after the assessment.
- External infrastructure
- Web applications and APIs
- Internal network and Active Directory
- Mobile apps, Wi-Fi and social engineering
Remediation
We deliver the quick wins and the 90-day plan; as a software company we also fix your applications.
- MFA, backups and hardening
- Segmentation and cloud configuration
- Patching and policies
- Code fixes in your own apps
Awareness and simulated phishing
A yearly program that changes habits, measured by area and never by person.
- 12 monthly campaigns
- 4 drills of increasing difficulty
- Onboarding and annual courses
- Quarterly reports
vCISO and monitoring
An external security officer and continuous monitoring without hiring a full team.
- Monthly security committee
- Risk register management
- Monthly scanning and leaked credentials
- Incident response playbook
LFPDPPP compliance
A short project to comply with Mexico's personal data protection law.
- Privacy notice
- Data inventory
- ARCO rights procedure
- Breach response plan
How we work
Seven phases with gates
Each phase ends with a deliverable you accept. No phase opens until the previous one is approved, and no technical test starts without the signed authorization letter.
- 0
Scoping
3 to 5 daysDiscovery call, proposal, NDA, contract and authorization letter (rules of engagement).
Deliverable: Signed proposal and documents
- 1
Planning and kickoff
2 to 3 daysClient liaison, required documents, CIS self-assessment and testing windows.
Deliverable: Audit plan
- 2
Discovery
5 to 7 daysInterviews with leadership, IT, HR and finance; asset inventory and data map.
Deliverable: Asset inventory and document matrix
- 3
Technical assessment
5 to 10 daysExternal and internal recon and scanning, configuration and identity review, simulated phishing.
Deliverable: Technical report with evidence
- 4
Risk analysis
3 to 5 daysSingle findings register, risk matrix, maturity by NIST function and remediation plan.
Deliverable: Risk register, scorecard and plan
- 5
Report and presentation
3 to 4 daysExecutive report and technical annex with peer review, presentations to leadership and IT.
Deliverable: Executive report, annex and closing act
- 6
Follow-up
Days 30, 60 and 90Progress calls and a 90-day re-audit with a before-and-after scorecard.
Deliverable: Re-audit report
Gate: each phase deliverable is accepted in writing before moving on.
Durations for the Standard package; Essential halves them and Comprehensive doubles them.
Packages
A scope that fits your company
Three packages by size and complexity. Pricing comes with the proposal, after the discovery call.
Essential
- For
- 1 to 50 employees, one site, no formal IT team, SaaS and laptops
- Scope
- Up to 30 devices, 1 network, 5 cloud services and 1 website
- Duration
- 2 weeks
- Framework
- CIS Controls v8.1 IG1 (56 safeguards)
Standard
- For
- 51 to 250 employees, 1 to 3 sites, small IT team, servers or cloud, ERP/CRM
- Scope
- Up to 150 devices, 3 networks, 20 services, 3 applications and a corporate directory
- Duration
- 4 weeks
- Framework
- CIS IG2 + NIST CSF 2.0
Comprehensive
- For
- More than 250 employees or a regulated industry (financial, health, fintech, government)
- Scope
- No fixed cap: sized by inventory, includes hybrid cloud and critical suppliers
- Duration
- 6 to 8 weeks
- Framework
- ISO 27001:2022 Annex A + CIS IG3 + sector regulations
If you handle card data, health data or more than 10,000 personal records, regulatory exposure moves you up one package.
What you get
Documents you use, not file away
One findings register feeds everything: leadership reads the executive report in 15 minutes and IT reproduces every finding with the annex.
Executive report
8 to 12 pages: overall risk level, critical findings in business language and three actions for this week.
Technical annex
Every finding with severity, evidence and steps to reproduce and fix it.
Maturity scorecard
Level 1 to 4 per NIST CSF 2.0 function and the share of CIS controls in place.
Remediation plan
Quick wins, 90 days and 6 to 12 months, with effort, estimated cost and suggested owner.
Closing act
Deliverables list with their digital fingerprints and a letter of open critical findings.
90-day re-audit
We measure again to confirm what was fixed and compare before and after.
Frameworks
International standards, Mexican context
CIS Controls v8.1
Operational control list
NIST CSF 2.0
Report structure and maturity
ISO/IEC 27001:2022
Compliance and path to certification
OWASP
Web, API and mobile applications
PTES · OSSTMM
Penetration testing methodology
LFPDPPP · CNBV · PCI DSS
Regulatory layer for your industry
Trust
Rules that protect your company
We will learn your weak spots; that is why we work under written rules applied on every project.
Nothing without signed authorization
NDA, contract and authorization letter with scope, schedules and an emergency contact before any test.
We never take your data
Once we prove an impact we stop; we document it with a minimal sample, without extracting real information.
People are protected
Phishing results are measured by area, never by person, and nobody is singled out.
Evidence encrypted and destroyed
Every file has a digital fingerprint and chain of custody; after 90 days it is destroyed and you receive a certificate.
Immediate alerts
If we find something critical we validate it by hand and tell you within 24 hours, without waiting for the report.
Awareness
One year to change habits
Technology is not enough if someone clicks. Our yearly program delivers one topic per month and measures progress.
- monthly campaigns
- 12
- phishing drills
- 4
- pieces per campaign
- 6
Jan
Spotting a fake email
Drill
Feb
Passwords and managers
Mar
Two-step authentication
Apr
WhatsApp, SMS and phone fraud
Drill
May
Confidential information
Jun
Devices and Wi-Fi
Jul
CEO and supplier fraud
Drill
Aug
Ransomware and backups
Sep
How to report an incident
Oct
Cybersecurity Awareness Month
Drill
Nov
Online shopping
Dec
Year in review
Free self-assessment
What does your company need? Find out in 5 minutes
The online self-assessment will be available soon. Meanwhile, write to us and we will run the pre-qualification by phone.
FAQ
What people ask us before starting
Will you access my systems?
Only what you authorize in writing in the authorization letter: assets, schedules, allowed and forbidden techniques. Without that signed document no technical test is run.
What happens if you find something critical?
We validate it by hand to rule out false positives and tell you within 24 hours, with a containment recommendation, without waiting for the final report.
Does the audit disrupt operations?
No. Tests run in agreed windows, we do not run load or stress tests and we stop once an impact is proven. There is a stop word and an emergency contact.
Who sees my data?
Only the assigned team, under NDA. Evidence is stored encrypted with chain of custody, reports travel encrypted and raw evidence is destroyed 90 days after closing.
How long does it take?
Between 2 and 8 weeks depending on the package: Essential 2 weeks, Standard 4 and Comprehensive 6 to 8. Follow-up continues at 30, 60 and 90 days.
Do you also fix what you find?
Yes. Remediation is offered as a separate project: quick wins, configuration, policies and, as a software company, code fixes in your applications.
Will it help with a client or an insurer?
Yes. The report, scorecard and remediation plan are evidence of due diligence, and we can issue a summary letter without technical details for third parties.
Do you invoice in Mexico?
Yes. Cerezasys is a Mexican company and issues a CFDI for each payment: 50% upfront and 50% upon the closing act.
Start by knowing where you stand
The self-assessment gives you a starting point today; the audit, a plan for the next 12 months.