Services
Four fronts, one way of working.
We carry out manual exploitation with verifiable evidence for every finding, delivering reports technical teams can act on without interpretation. The scope, the rules of engagement and the testing window are set transparently and in writing before any activity begins.
Offensive security
Manual pentesting against the surface you actually expose. Real exploitation and a reproducible proof of concept for every finding, not a list of scanner output.
What we cover
Web applications
Authentication, access control, business logic and injections. Coverage guided by the OWASP Top 10 and OWASP ASVS, with chained exploitation wherever it exists.
API
REST, GraphQL and SOAP. Object- and function-level authorization, excessive data exposure, rate-limiting abuse. Reference: OWASP API Security Top 10.
Mobile
Android and iOS. Insecure local storage, certificate pinning, anti-tampering protections and the backend sitting behind the app.
Cloud
AWS, Azure and GCP. IAM review and privilege escalation, exposed buckets and storage, poorly segmented networks and secrets leaked in configuration.
AI and LLM
Direct and indirect prompt injection, system prompt leakage, RAG context poisoning and tool or agent abuse. Reference: OWASP Top 10 for LLM Applications.
Code analysis
Reviewing the application from the inside and from the outside. Every automated alert is manually validated before it reaches the report: without triage, a SAST run is mostly noise.
What we cover
SAST
Static analysis over source code. Catches insecure patterns and tainted data flows before deployment, including code no dynamic test ever reaches.
DAST
Dynamic analysis against the running application. Finds what only shows up live: environment configuration, sessions and runtime behaviour.
MAST
Mobile-specific analysis, static and dynamic, over the binary and the traffic. Reference: OWASP MASVS and MASTG.
Banking core
Assessment of financial platforms, where failure is not a data leak but an altered transaction. The team brings prior experience across Mexican SOFIPOs, insurers and banks. Always performed under an agreed window and signed rules of engagement.
What we cover
Core platform
Integrity of transactional logic, dual-control checks, segregation of duties and traceability of sensitive operations.
Interfaces and messaging
Integration channels and financial messaging (ISO 8583, ISO 20022, SWIFT): field validation, replay, amount tampering and idempotency control.
Channels and perimeter
Online banking, the mobile app and the APIs behind them, along with the network segmentation separating the core from the rest of the organization.
PCI DSS analysis
Technical work on the cardholder data environment (CDE) so the formal assessment arrives without surprises.
What we cover
Gap analysis
Review of the CDE against the PCI DSS v4.0 requirements, with the real distance to compliance and a prioritized remediation plan.
PCI-scoped pentest
The internal and external penetration test required by Requirement 11.4, with methodology, scope and evidence documented the way the standard asks for.
Segmentation testing
Verification that segmentation controls genuinely isolate the CDE, per Requirements 11.4.5 and 11.4.6, to support scope reduction.
Caveat
Argus RK is neither a QSA nor an ASV. We perform the technical work and the penetration testing the standard requires, and prepare the evidence; the formal assessment and the signing of the RoC or SAQ belong to an accredited QSA, and the quarterly external scan to an ASV.
Complementary service
Threat intelligence (CTI)
Watching what happens outside your perimeter: what is being said about your brand, what information of yours is circulating, and what sits exposed without anyone having published it on purpose. Corroborated, actionable intelligence, not a dump of automated alerts.
How it is engaged
It can be engaged on its own or added to any of the four services above. Unlike a penetration test, which is a point-in-time exercise run against your systems, CTI is continuous and observes external sources only.
What we monitor
Digital fraud and brand protection
Lookalike domains, cloned sites, and profiles or apps impersonating the organization. Early detection of phishing campaigns trading on your name, tracked through to takedown.
Piracy monitoring
Unauthorized distribution of your products, licences or content across marketplaces, forums and messaging channels, with the evidence needed to act on it.
User exposure
Credentials, accounts and data belonging to staff and customers surfacing in breaches and dumps. We verify what is still valid and what genuinely grants access.
Exposed information
Documents, code, secrets and configuration published by mistake in repositories, cloud storage, internal portals and open services.
Deep and dark web mentions
Tracking of the organization, its sector and its supply chain across closed forums, markets and extortion channels, including ransomware groups' leak sites.
Attack surface
A continuous inventory of what faces the internet: assets, services, technologies and versions, matched against the threats that actually affect your sector.
CTI process
The intelligence cycle, phase by phase.
No phase gets skipped: useful intelligence is not an isolated finding but the result of collecting, corroborating and analysing before asserting anything. The cycle repeats, it does not end.
- 01
Definition and requirements
- Identifying objectives and needs.
- Identifying the brand, assets and technologies relevant to the organization: name, logos, domains, software versions and official channels.
- Defining intelligence requirements.
- Defining information sources.
- Defining scope.
- 02
Collection
- Identifying relevant sources.
- Collecting information.
- Monitoring external sources.
- Obtaining threat-related information.
- Collecting indicators and relevant data.
- Identifying information related to potential risks.
- 03
Processing
- Organizing the collected information.
- Validating the information.
- Removing duplicate or irrelevant information.
- Classifying the information.
- Correlating information from different sources.
- Enriching the information.
- Assessing the reliability of the information.
- Identifying relationships between the data obtained.
- 04
Intelligence analysis
- Analysing the information obtained.
- Identifying potential threats.
- Identifying patterns and trends.
- Analysing relevant behaviours and activity.
- Evaluating possible scenarios.
- Identifying risks.
- Generating hypotheses.
- 05
Production and dissemination
- Producing intelligence.
- Writing reports and alerts.
- Communicating relevant findings.
- Producing recommendations.
- Adapting the information to the reader's needs.
- Supporting decision-making.
- 06
Monitoring and follow-up
- Continuous threat monitoring.
- Identifying trends, new events or changes.
- Updating existing information.
- Tracking identified risks.
- 07
Continuous improvement
- Identifying opportunities for improvement.
- Identifying additional information needs.
- Updating sources and tooling.
- Adjusting processes and methodologies.
Complementary service
Secure development
Security inside the development cycle, not bolted on at the end. We work alongside the team from requirements through to release, so most flaws never get written and the ones that do are fixed while they are still cheap.
How it is engaged
It can be engaged on its own or added to any of the four services above. It embeds with the development team during the project, rather than assessing it once it is finished.
What it covers
Security requirements
System purpose, roles, sensitive data, integrations and regulatory obligations, turned into verifiable requirements before any code is written.
Design and threat modelling
Architecture review, threat identification, and definition of authentication, authorization and encryption controls, including the design of APIs and integrations.
Practices during development
Input validation, safe error handling, session management, access control, and protection of credentials and secrets, with OWASP as the reference.
Code and component review
SAST with manual triage of critical code, dependency analysis (SCA), vulnerable components, exposed secrets and insecure configuration.
Security testing
DAST against the running application, web and API testing, validation of authentication, authorization and sessions, OWASP Top 10, and a penetration test where it applies.
Remediation and release
Vulnerability prioritization, hands-on support for the team during fixes, retesting of what was corrected, and a review before the move to production.
Secure development process
From requirements to release, without leaving security until the end.
Each phase produces something verifiable before the next one starts. The cost of fixing a flaw grows with every phase it survives, which is why the work begins before any code exists.
Phases at a glance
- 01
Requirements gathering
- Understanding the purpose of the system.
- Identifying users and roles.
- Identifying sensitive information.
- Identifying integrations and external services.
- Defining security requirements.
- Identifying regulatory or compliance obligations.
- 02
Secure design
- Architecture review.
- Risk identification.
- Identification of potential threats.
- Definition of authentication controls.
- Definition of authorization controls.
- Protection of sensitive information.
- Definition of encryption mechanisms.
- Secure design of APIs and integrations.
- 03
Secure development
- Application of secure development practices.
- Input validation.
- Safe error handling.
- Protection of credentials and secrets.
- Secure session management.
- Implementation of access controls.
- Application of OWASP-based practices.
- 04
Code and component review
- Static code analysis (SAST).
- Manual review of critical code.
- Dependency and library analysis (SCA).
- Identification of vulnerable components.
- Detection of exposed secrets and credentials.
- Identification of insecure configuration.
- 05
Security testing
- Dynamic application analysis (DAST).
- Security testing of web applications.
- Security testing of APIs.
- Validation of authentication and authorization.
- Validation of session handling.
- OWASP Top 10 validation.
- Manual security testing.
- Penetration testing where it applies.
- 06
Remediation
- Classification and prioritization of vulnerabilities.
- Recommendations for fixes.
- Hands-on support for the development team.
- Vulnerability tracking.
- Validation of implemented controls.
- 07
Revalidation and release
- Retesting of corrected vulnerabilities.
- Validation of security controls.
- Review before the move to production.
- Identification of outstanding risks.
- Final security report.
- Release approval once the defined criteria are met.
Does any of this match what you need?
Tell us the scope and we send back a technical proposal in under 48 hours.