Pentesting service in Chile for web, API, and cloud
Pentesting service in Chile across web applications, APIs, and cloud. We do not hand over scanner lists: we hand over reproducible evidence, an executive and technical report, and a plan to mitigate.
Find what an attacker would find, before they do.
From 25 UF + VAT for a scoped web or API pentest.
A team of experts
Our work shows up inside large companies across Latam.
A summary for leadership, reproducible evidence per finding, and prioritization by severity and business impact.
- Executive report plus a compliance certificate
- Executive summary for non-technical stakeholders
- Technical detail with reproducible evidence
- Compliance certificate for due diligence
- Faster enterprise closes and vendor audits
- Authentication, session management, and privilege escalation
- Sensitive data exposure and validation failures
- Insecure configuration and hardening gaps
- Modern attack vectors in applications and APIs
Methodology
The pentesting service in Chile follows OWASP for web applications and APIs, and PTES for the engagement cycle: scope, reconnaissance, exploitation, and reporting. It is not an automated scan.
- OWASP Web Security Testing Guide on web applications.
- OWASP API Security on interfaces.
- PTES: scope, intelligence, exploitation, and reporting.
- Reproducible evidence per finding, not a scanner list.
Deliverables
Leadership and engineering receive different pieces of the same engagement.
- An executive report for the people who decide.
- A technical report with reproducible evidence.
- A retest when the scope includes it, after mitigation.
Timelines
The quote goes out within 24 hours. The initial diagnosis takes 30 minutes and has no cost. The work calendar is set in the proposal, after that diagnosis.
2026 reference prices
Reference prices in UF, plus VAT. The final price comes from a short diagnosis, with no commitment.
Pentest pricing in Chile: ranges and what is includedFrom 25 UF + VAT
Scoped gray box. One application or a limited set of APIs, with a report and a mitigation plan.
Based on scope
Several surfaces, environments, or a retest. A proposal with hours, timelines, and deliverables after the diagnosis.
Quoted
Chatbots, copilots, and agents with tools or MCP. Not included in the web/API floor.
What this looks like in practice
From the report to the mitigation plan: exploitability, owner, and evidence, not only CVSS.
Continuous coverage with top-tier researchers. onenorma's fee is 5% of each reward.
When the risk is in the chatbot or the agent, the 25 UF floor does not apply: that is an LLM pentest.
2026 shortlist: onenorma and four other real profiles. How to choose without an official ranking.
Pentesting and compliance with Law 21.663 and Law 21.719 for SMEs and teams in the Santiago Metropolitan Region.
Frequently asked questions
How much does a pentest cost in Chile and Latam?
- A scoped web or API pentest starts at 25 UF + VAT. If there are several applications, infrastructure, or a broad retest, we quote after a short diagnosis. The floor is public so you can compare; the final price comes from the scope, not from a generic scanner.
What does the pentest from 25 UF include?
- Gray box on one web application or a limited set of APIs: offensive tests, an executive report, reproducible evidence per finding, and a prioritized mitigation plan. It is not a scanner dump. Outside that scope (several surfaces, mobile, internal network) we quote separately.
Do you do white-box, gray-box, and black-box pentests?
- Yes. Black box simulates an external attacker with no credentials. Gray box is the most common scope: a real user plus app context. White box includes code or architecture. We recommend the type based on the risk and what due diligence or Law 21.663 will ask for.
Does it help with Law 21.663, ANCI, or customer due diligence?
- Yes. We deliver prioritized findings, evidence, and, when it applies, a compliance certificate. That is what enterprise customers, vendor audits, and a diligence file for ANCI or Chile's cybersecurity framework law 21.663 ask for.
Do you cover web, API, and retest?
- The typical scope is web and API. Infrastructure, mobile, or a retest after mitigation go into the proposal. If the risk is in a chatbot or an agent, the right service is AI pentesting, not this 25 UF floor.
The pentest and the executive report from the onenorma team were very detailed, letting us act quickly and mitigate every finding in a straightforward way. Communication was fast and very clear.
Ready when you are.
Book your strategy session or email us: we reply with a clear scope and the next step.
30 minutes · No commitment · You leave with an action plan for the deals that stall