About us
About Pentest Machine
We are an offensive security boutique. We test web applications, APIs, cloud and AI systems the way a real attacker would — with senior specialists doing the attacking and the founder involved in every engagement.
Who we are
Pentest Machine is headquartered in São Paulo with presence in Lisbon and Miami, serving companies across the US, Europe and Brazil in English, Portuguese and Spanish. Our focus is offensive security: finding and proving, with a proof of concept, the flaws automated tools miss — and helping fix them.
The founder
Our founder brings more than 20 years of security experience, an international career at six of the world's largest companies, and talks at OWASP AppSec USA, Black Hat and several BSides conferences. He runs part of the testing himself and is accountable for the quality of every delivery: no report ships without his review.
How we work
- Manual and senior: specialists attack your application; in-house tooling and AI speed up the repetitive work.
- Open methodology: OWASP Top 10, WSTG, ASVS, OWASP API Security Top 10, OWASP Top 10 for LLM Applications and MITRE ATLAS.
- Transparency: fixed price within 24h, NDA before scoping, immediate notice of critical findings and retest included.
- Audit-ready reports: SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, NIS2 and DORA.
What we publish
We share what we know: technical articles on our blog, an e-book on testing AI applications and the External Security X-Ray, a free passive check of your domain.
Contact
Email contato@pentestmachine.com or request a quote — an expert replies within 24 hours.
Frequently asked questions
Who is behind Pentest Machine?
A founder with 20+ years of security experience, an international career at six of the world's largest companies and talks at OWASP AppSec USA, Black Hat and BSides, who runs part of the testing and reviews every delivery, supported by senior specialists.
Where does Pentest Machine operate?
Across the US, Europe and Brazil, headquartered in São Paulo with presence in Lisbon and Miami, with local invoicing.
What kinds of penetration testing does Pentest Machine do?
Web application, API (REST, GraphQL, gRPC), cloud and external infrastructure, DDoS and AI/LLM penetration testing.
Other services
Request a quote
Get a proposal within 24h.
Tell us what you need tested. An expert — not a salesperson — replies with scope, timeline and price.
- NDA available before any detail is shared
- Support in EN, PT and ES
- Invoicing in the US, EU or Brazil