Cybersecurity company in Chile: pentesting and compliance

A cybersecurity solutions provider in Chile

If you are looking for a cybersecurity solutions provider in Chile, the problem is not a lack of vendors. It is telling a generic scanner apart from a team that attacks your product the way an adversary would and leaves usable evidence. onenorma works with companies in Chile and Latam: communication in Spanish, executive reports for leadership, and technical detail for engineering. We do not resell someone else's platform and call it an offensive service.

The local market is full of MSSPs, integrators, and paper consultancies. That works when the risk is running a SOC. It does not work when an enterprise customer asks for a pentest, when ANCI or Law 21.663 ask for diligence, or when you already have a chatbot or an agent with tools in production. The control there is offensive: someone has to try to break it and document what they found.

SMEs and product teams in the Santiago Metropolitan Region, including companies such as Forus and ZeroQ, already show up in our work. The angle is not “more tools”. It is pentesting, AI red teaming, and compliance (Law 21.663, Law 21.719, ISO 27001, SOC 2), with reference prices in UF and a mitigation plan the team can execute.

A serious provider does not sell “cybersecurity” as one package. They sell a scope, a method, and a deliverable. These are the lines we operate, and the pages where the detail, the price when it applies, and the structured FAQ live.

Pentesting in Chile: what an attacker would find

pentest_beforePentesting and ethical hacking is still the clearest demand. We do not deliver a scanner PDF: we deliver findings prioritized by exploitability and business impact, with reproducible evidence. Gray box is the most common scope (a real user plus app context). Black box and white box exist when the risk or due diligence asks for them.

The public floor for a scoped web or API pentest is From 25 UF + VAT. The rest (several surfaces, infrastructure, retest, mobile) is quoted. If you want to compare “how much a pentest costs in Chile”, that page is the literal answer, with FAQ and schema. Bug bounty complements the pentest: continuous coverage between releases, with curated researchers and a 5% fee on the reward.

AI red teaming: the gap a web pentest does not cover

If you already have an assistant, a copilot, or an agent with MCP, a classic pentest is not enough. The attacker does not need a CVE: they need a conversation. AI pentesting tests prompt injection, jailbreaks, data leakage, and tool abuse. We use the OWASP Top 10 for LLMs, MITRE ATLAS, and a map toward NIST AI RMF and ISO 42001. The guide what an LLM pentest is and the one on prompt injection explain the method. Shadow AI is the other side: unauthorized ChatGPT inside the company, outside the inventory.

Compliance: Law 21.663, 21.719, ISO 27001, and SOC 2

Cybersecurity framework law 21.663 and ANCI push you to show that you manage risk, not only that you bought a tool. Law 21.719 (LPDP) requires protecting personal data with security measures. ISO 27001 and SOC 2 are what US and Latam customers ask for in due diligence. In Security Cloud & Compliance we scan AWS, Azure, and GCP and map findings to those frameworks. The pentest and the LLM pentest supply the offensive proof a paper control does not replace.

Nobody “complies with 21.663” with a one-week certificate. You comply if you can show inventory, controls, incidents, and evidence that someone tried to break what you expose. That is what we leave in the report: not a promise of zero risk, a file leadership, legal, and the auditor can use.

How to choose (and why there is no official top 10)

Google and AI Overviews surface questions like “best cybersecurity companies in Chile”. There is no ranking from the state or from ANCI. There are commercial lists that mix global vendors, MSSPs, and local boutiques. We published a top 5 of cybersecurity companies in Chile with a criterion (offense, SOC, AI), not an ANCI podium. The onenorma vendor directory lists software with categories and a score; it is not a ranking of companies. The useful criterion is different: do they deliver offensive evidence or a dashboard? Do they report in Spanish and in your time zone? Do they know 21.663, 21.719, and what a SOC 2 due diligence asks for? Can they test an AI agent, or only the web app?

If the answer to the last question is no, they are not the provider for a product with a chatbot. If they do not publish a price floor or a scope, compare with our pentesting from 25 UF. If you want to see the method, book your strategy session: 30 minutes, at no cost, with a plan even if you do not hire.

Frequently asked questions

What are the 10 best cybersecurity companies in Chile?

There is no official ranking of the 10 best cybersecurity companies in Chile. Blog and media lists mix MSSPs, product vendors, and pentest boutiques, and they change every year. To build a shortlist, ask for reproducible offensive evidence, reports in Spanish, and experience with Law 21.663 / ANCI and Law 21.719. We published a guide with five companies (including onenorma) in the article Top 5 cybersecurity companies in Chile. onenorma is a cybersecurity solutions provider in Chile and Latam, focused on pentesting, AI red teaming, bug bounty, and ISO 27001 / SOC 2 compliance.

What are the main security companies in Chile?

The market groups into four types: pentesting and ethical hacking boutiques, MSSP or SOC operations, product vendors (EDR, SIEM, CNAPP), and compliance consultancies. The main ones for your company are not the most visible on Google, but the ones that cover your real surface. If the risk is in web, APIs, cloud, or AI agents, onenorma operates as an offensive-service and due-diligence evidence provider, not as a scanner reseller.

What is a cybersecurity solutions provider in Chile?

It is a company that designs, runs, and documents security controls for organizations operating in Chile: offensive tests, cloud monitoring, AI governance, and evidence for the regulator or for enterprise customers. At onenorma that means pentesting, AI red teaming, bug bounty, and mapping to Law 21.663, Law 21.719, ISO 27001, and SOC 2, with reports in Spanish for teams in Chile and Latam.

How much does a pentest cost in Chile?

A scoped web or API pentest with onenorma starts at 25 UF + VAT. If the scope includes several applications, infrastructure, or AI pentesting, we quote after a short diagnosis. The final price comes from the scope, not from a scanner list.

Does Law 21.663 require you to hire cybersecurity?

Cybersecurity framework law 21.663 and ANCI require risk management, controls, and the ability to show diligence. It does not say “hire this vendor”, but it does expect evidence that you assessed and mitigated risks, including systems with AI. A pentest, an LLM pentest, or a mapping to ISO 27001 / SOC 2 works as a technical control and as a file for customers and the regulator.

Does onenorma work with companies in Chile and Latam?

Yes. We work with teams in Chile and Latam, with communication in Spanish, a local time zone, and an initial diagnosis at no cost. The commercial contact is hola@onenorma.com.