InteractionBP

Security for applications, cloud, and AI

Three packages, each with a defined scope and timeline. The amount is fixed in writing before we start.

Request a free external scan
01

Security Assessment

Timeline
2 weeks
Request a proposal

Who it's for

A company that received a security questionnaire from a customer, bank, or auditor, or that has never been tested.

Scope

  • External attack surface: subdomains, ports, certificates, email, leaked credentials
  • Pentest of one web application or API, following the OWASP WSTG
  • Review of one AWS, Azure, or GCP account against the CIS Benchmarks

Deliverable

Report with executive summary, findings by risk, steps to reproduce, and fix guidance. Help answering the questionnaire. One retest included.

02

Fix and Harden

Timeline
Monthly, no lock-in
Request a proposal

Who it's for

Teams that have findings in hand and no time to fix them.

Scope

  • Findings fixed through pull requests in your repository
  • CI checks: static analysis, vulnerable dependencies, and secrets in code
  • Access and permission cleanup, MFA for every user
  • Backup and restore test
  • Incident response runbook
  • LGPD technical measures: access logs, data inventory, breach notification procedure. Not legal advice.

Deliverable

Reviewable pull requests and a monthly report of what was fixed and what remains.

03

Security for AI Applications

Timeline
2 weeks
Request a proposal

Who it's for

Companies running a chatbot, agent, RAG system, or copilot in production.

Scope

  • Prompt injection and jailbreaks, direct and through external content
  • Data leakage through tools and document retrieval
  • Permission audit for every tool the agent can call
  • RAG access control: who can read what
  • Handling of model output before it reaches other systems
  • Implementation of the protections by our team (optional)

Deliverable

Report based on the OWASP Top 10 for LLM Applications, with the prompts that worked and the fix for each one.

Method

We use public references so you and your auditor can check what was done.

  • OWASP Web Security Testing Guide (WSTG) for web applications and APIs
  • OWASP Top 10 for LLM Applications for AI applications
  • CIS Benchmarks for AWS, Azure, and GCP
  • PTES for how the test is run

Frequently asked questions

Who runs the tests?

Every project is run by senior specialists on our team. We do not hand work to beginners, and we do not deliver scanner output as a report.

Will you take my system down?

We don't run denial-of-service tests. We agree on time windows, use a staging environment when one exists, and warn you before any test that could cause impact.

Can I use the report for audits and customer questionnaires?

Yes. It includes scope, method, findings ranked by risk, and the retest result. We also help you answer the questionnaire your customer sent.

Do you fix what you find?

Yes, in the Fix and Harden package. Our team delivers fixes as pull requests for your developers to review.

Do you cover LGPD?

We handle the technical measures: access logs, data inventory, access control, and the incident notification procedure. We don't give legal opinions.

Free external scan

Give us your domain. Within 2 business days you get an email summary of what your company exposes to the internet.

What we check

  • Publicly visible subdomains
  • Open ports and services
  • Certificate validity and configuration
  • Email spoofing protection (SPF, DKIM, DMARC)
  • Credentials from your domain in known leaks

Passive, non-intrusive checks only. Nothing is exploited.