¿De verdad usan IA? ¿Es tan rigurosa como el hacking ético manual?

Sí — y es híbrido por diseño. Nuestros agentes de IA están entrenados con el mismo playbook que ejecutaría un operador senior (reconocimiento, explotación, encadenamiento de rutas de ataque), pero nunca trabajan solos. Un operador humano certificado supervisa cada sesión en tiempo real y hace pruebas manuales en paralelo. Cada hallazgo — lo haya encontrado el agente o el operador — se reproduce y lo firma una persona antes de llegar a tu portal. La misma profundidad que un adversario real, sin el ruido de un escáner genérico.

¿Qué es el hacking ético continuo con agentes de IA?

Es seguridad ofensiva siempre encendida. En vez de una prueba puntual una vez al año, nuestros agentes de IA auditan tu superficie de ataque de forma continua —reconocimiento, explotación y encadenamiento sin pausa— y los operadores certificados validan y firman cada hallazgo nuevo apenas aparece. Importa porque los atacantes ya usan IA para encontrar y explotar fallas a velocidad de máquina, y un pentest anual deja meses de exposición ciega entre auditorías. Con el modelo continuo, cada cambio que despliegas (un release, una integración nueva, un endpoint expuesto) se vuelve a probar en días, no en meses — y cada hallazgo lo sigue firmando una persona real.

¿Sus operadores solo supervisan a la IA, o también prueban directamente?

Ambas, en cada engagement. Los operadores lideran el kickoff y el modelo de amenazas, diseñan escenarios de ataque a medida que los agentes no pueden replicar (abuso de lógica de negocio, flujos de autenticación de varios pasos, rutas de ingeniería social) y ejecutan pruebas manuales en paralelo con los agentes de IA — sobre todo en exploits encadenados, donde el contexto es lo que más importa. La IA acelera la cobertura; el operador aporta criterio, creatividad y responsabilidad. Cada QRC en tu portal lo firma una persona real, certificada y con nombre.

¿Cómo son los plazos de un engagement?

La consultoría gratuita y la definición de alcance toman una sola llamada. La mayoría de los engagements se ejecutan en 4 a 7 días de punta a punta — los agentes de IA mapean la superficie y encadenan hallazgos a velocidad de máquina mientras los operadores supervisan en vivo y hacen sus propias pruebas manuales. Los hallazgos críticos se divulgan dentro de 24 horas.

¿Las pruebas van a afectar nuestros sistemas en producción?

No. Acordamos las reglas de engagement por adelantado, trabajamos dentro de ventanas definidas, y tanto los agentes como los operadores usan técnicas de explotación seguras y acotadas a tu alcance. Las pruebas destructivas solo se hacen contra objetivos aprobados y con autorización explícita.

¿Hacen re-test después de que remediamos?

Siempre. El mismo operador que firmó el hallazgo original re-valida la corrección, y trabajamos contigo en el hardening para que esa ruta de ataque no se vuelva a abrir. Los re-tests están incluidos, no son un costo extra.

¿Qué certificaciones tiene su equipo?

Nuestros operadores tienen credenciales ofensivas reconocidas en la industria, incluyendo OSCP, OSWA, PWPA, CRTO, eWPTX y BSCP, respaldadas por años de experiencia real en hacking ético. Cada hallazgo publicado lleva el nombre y la firma del operador — nunca la salida anónima de una herramienta.

How to prepare for an offensive security exercise and truly make the most of it

When a company hires us for an offensive security exercise, it's common that, in the days beforehand, the IT team starts applying patches, removing old access, and reviewing configurations so everything is in the best possible shape by the time of the assessment. Although the intention is understandable, this approach is not always the right one.

An offensive security exercise is meant to evaluate the real state of the organization and reflect the level of security it operates with day to day. Making rushed changes before the assessment can hide vulnerabilities that would still be present under normal conditions, reducing the value of the exercise.

Instead of focusing on fixing problems at the last minute, it's more important to prepare what's needed for the assessment to run in an orderly way and deliver representative results.

Below, we'll go over the main points worth having ready.

Define the scope and the objectives

Before starting the exercise, define in writing which assets will be evaluated and which will be out of scope, such as domains, applications, IP ranges, accounts, and environments.

Having a clearly defined scope avoids misunderstandings and lets the assessment focus on the assets that matter most to the organization.

It's also important to set the objectives from the start. Evaluating the exposure of external services is not the same as analyzing the impact of an attacker with initial access to the internal network.

Have the access and information ready

If the assessment requires credentials, test accounts, or access to a specific environment, try to have them available before it begins.

Delaying the delivery of access reduces the effective time of the assessment.

It's advisable to have:

Test accounts with the agreed permissions.
Relevant documentation, such as architecture diagrams, endpoints, and environments.
A contact channel to resolve questions or grant access during the exercise.

Inform the right people

Define who within the organization will be aware of the exercise and who won't. Informing the right people keeps the assessment team's activity from being interpreted as a real incident and triggering unnecessary procedures.

At the same time, keeping the rest of the organization unaware allows a more representative view of how it responds to suspicious activity.

Avoid last-minute changes

Applying patches, changing configurations, or removing access right before the assessment can distort the results, since the exercise will end up reflecting an environment different from the one that runs day to day.

If you spot something you want to fix, note it down and raise it with the assessment team. It can be reviewed during the exercise and fixed afterward, with a clearer picture of your real level of exposure.

The most important part: managing the findings

The value of an offensive security exercise lies not in the report itself, but in the actions taken based on its results. Before starting, it's worth defining how findings will be received, prioritized, and remediated, as well as who will be responsible for each stage.

In practice, this tends to be the most neglected phase. It's common to find organizations that receive relevant findings but take no concrete action to resolve them. The report is filed away, the vulnerabilities stay open, and over time the follow-up is lost. An offensive security exercise does not reduce risk on its own; its purpose is to identify it and make it visible.

Risk is reduced when findings are prioritized, fixed, and then verified to confirm the measures put in place are effective. To make this easier, it helps to define from the start:

Who will be responsible for reviewing and prioritizing the findings.
The remediation timelines based on the criticality of each vulnerability.
The process for validating the fixes, ideally through a re-test.
A point of contact to coordinate the follow-up during and after the assessment.

Cybersecurity is not only about running a periodic assessment, but about managing the risks you find and following up on remediation.

At Quarancle, every finding is recorded in real time inside the portal, including its severity, evidence, and reproduction steps. You can also request a re-test of the fixed vulnerabilities, making it easier to follow up on and validate the remediations.