Code review
Secure development from the first commit: SAST, SCA, and expert manual review.
Pentesting and ethical hacking
A security team for products that are already in the market, or about to be. We combine pentesting, cloud, compliance, and AI governance, and we hand you an executive report so you can act fast.
30 minutes · No commitment · You leave with an action plan for the deals that stall
A team of experts
Our work shows up inside large companies across Latam.01 · What we do
Six security practices, one team.
Each service can be hired on its own or combined, depending on your product stage and what the market is asking for.
Pentesting, Ethical Hacking
Penetration testing with a professional methodology across web, APIs, and infrastructure.
AI Red Teaming
Adversarial attacks on your AI agents and models, before someone else does it.
Security Cloud & Compliance
Continuous scanning of AWS, Azure, and GCP, mapped to the frameworks your customers require.
MCP development
Custom MCP servers that connect your AI agents to real systems, with fine-grained control.
onenorma Suite
MCP Governance, Vulnerability Management, and SBOM in one dashboard.
02 · Our two most requested practices
Offense and compliance, with evidence.
This is where most of our customers start: find the real risk in production and prove, with evidence, that their cloud infrastructure complies. To hire in Chile, start with our cybersecurity company in Chile.
Primary service
Pentesting service in Chile for web, API, and cloud
Find what an attacker would find, before they do.
Pentesting service in Chile across web applications, APIs, and cloud. We do not hand over scanner lists: we hand over reproducible evidence, an executive and technical report, and a plan to mitigate.
View serviceWhat you receive
A summary for leadership, reproducible evidence per finding, and prioritization by severity and business impact.
- Executive report plus a compliance certificate
- Executive summary for non-technical stakeholders
- Technical detail with reproducible evidence
- Compliance certificate for due diligence
- Faster enterprise closes and vendor audits
What we assess
- Authentication, session management, and privilege escalation
- Sensitive data exposure and validation failures
- Insecure configuration and hardening gaps
- Modern attack vectors in applications and APIs
Primary service
Security Cloud & Compliance
Connect AWS, Azure, and GCP. We watch, prioritize, and document.
We scan multi-cloud misconfigurations and compliance gaps on a schedule. Every finding lands in onenorma Dash, with prioritized mitigation plans assisted by AI.
View serviceFrameworks we cover
We map each finding to the framework the market or the regulator is asking you for.
- Multi-cloud compliance
- SOC 2
- ISO 27001:2022
- NIST
- CIS AWS Foundations
- LPDP (Law 21.719)
- And more
What you receive
- Executive summary for non-technical stakeholders
- Technical detail with reproducible evidence
- Compliance certificate for due diligence
- Faster enterprise closes and vendor audits
03 · The rest of the catalog
Code, AI, and the platform that connects it.
Service
Code review and secure development
Security from the first commit.
- Manual review of business logic and authorization
- SAST and dependency analysis (SCA) in CI/CD
- Detection of secrets exposed in the repository
- Threat modeling
Service
AI Red Teaming
We test your agents before an attacker does.
- Prompt injection, jailbreaks, and guardrail bypass
- Tool abuse and function calling / MCP
- Assessment aligned to the OWASP Top 10 for LLMs with Agentics and MITRE ATLAS
Service
MCP development
Connect your agents to real systems, without backdoors.
- Tools with the least privilege required
- Authentication and authorization per agent and organization
- Full traceability of every invocation
The pentest and the executive report from the onenorma team were very detailed, letting us act quickly and mitigate every finding in a straightforward way. Communication was fast and very clear.
04 · How we work
A clear methodology, no surprises.
We deliver prioritized findings, reproducible evidence, and, when it applies, a compliance certificate. The same process applies whether you hire one service or all six practices together.
Diagnosis
Scope and goals: we define what gets assessed (code, cloud, AI agents, or infrastructure) and the success criteria.
Expert work
Our team runs the assessment or the implementation with a documented methodology, not only automated tools.
Evidence
Report and certification: prioritized findings, reproducible evidence, and, when it applies, a compliance certificate.
Continuity
Continuous monitoring: with onenorma Dash the work does not end at the report; we keep watching and prioritizing what is new.
05 · Frequently asked questions
Clear answers before you book.
What teams ask us most about pentesting, bug bounty, AI red teaming, compliance, and how we work in Chile and Latam.
The public ranges, in UF, are on pentest pricing in Chile.
How much does a pentest with onenorma cost?
- A scoped web or API pentest starts at 25 UF + VAT. If the scope includes several applications, infrastructure, or AI pentesting, we quote after a short diagnosis. You can book a strategy session or request the catalog to start.
What is the difference between pentesting and AI red teaming?
- Pentesting assesses applications, APIs, and infrastructure with a traditional offensive methodology. AI red teaming tests AI agents and models against prompt injection, jailbreaks, tool/MCP abuse, and failures aligned to the OWASP Top 10 for LLMs. You can hire either one, or both.
Do you cover ISO 27001, SOC 2, and other frameworks?
- Yes. In Security Cloud & Compliance we scan AWS, Azure, and GCP and map findings to frameworks such as SOC 2, ISO 27001:2022, NIST, CIS AWS Foundations, and Chile's LPDP (Law 21.719), among others. We deliver evidence you can use in audits and due diligence.
Do you work with teams in Chile and Latam?
- Yes. We work with companies in Chile and Latam, with communication in Spanish, executive reports for non-technical stakeholders, and reproducible technical detail for engineering.
How much does a bug bounty program cost?
- onenorma's fee is 5% of what you pay the researcher for each valid reward. You set the bounty table. The program is built for Chile and Latam, with top-tier researchers.
What do we get at the end of an engagement?
- Findings prioritized by severity and business impact, reproducible evidence, an executive summary, and, when it applies, a compliance certificate. The goal is that you can mitigate fast and show progress to customers or auditors.
What is MCP development, and why does security matter?
- An MCP server connects AI agents to real systems (APIs, data, tools). We design it with least privilege, authentication and authorization per agent, and traceability of every invocation, so production does not get a backdoor.
Ready when you are.
Book your strategy session or email us: we reply with a clear scope and the next step.
30 minutes · No commitment · You leave with an action plan for the deals that stall