Skip to content
CyberArmorApplication security engineering
São Paulo, Brasil · Service inside the product, not beside it

We run the work inside the product, not beside it.

Scanning, triage, compliance mapping and report drafting happen in the workspace you already pay for. There is no deliverable you wait for and no document at the end: what changes, changes on the screen, while it happens.

SARIFCYCLONEDXNESSUS XMLCSV
The four rules

These four rules are the offer

A service you cannot cancel on your own, and whose work leaves with the person who leaves, is a staffing contract with a product name on it.

  1. The work happens inside the workspace

    Scanning, triage, compliance mapping and report drafting run in the product you already pay for. What changes, changes on the screen, while it happens.

  2. Billing is by scope and service level

    Never by the hour, and never by days of presence. We do not sell a calendar of allocated time.

  3. Cancelling a service does not take the work with it

    The platform, the data and the work already done stay with you. Findings, marks, evidence and reports remain where they are.

  4. You buy and cancel on the same billing page

    From inside the workspace. No call to buy, and no call to leave.

One exception, while it is true: the platform is not live yet, so rule four has no screen. Today the way in is a conversation. This paragraph disappears the day the billing page exists.

How it is billed

Against the staffing model, not against a named competitor

The two ways this kind of work gets bought.
CriterionStaffing modelHere
Unit of billingAn hour, or a day of presenceContracted scope and service level
What you are buyingSomebody being thereEnvironments covered and deadlines met
Where the work shows upIn a document, laterIn your workspace, while it happens
When you cancelThe work leaves with the person who leavesThe platform, the data and the work stay with you
How you sign up and leaveA proposal, a call and a notice periodOn the same billing page as the plan
The scopes

What is actually contracted

Every count below was read in the platform source, engine by engine. None was rounded from a brief.

  • SAST

    We configure and keep the engines running

    198 code rules across 14 languages, 31 secret patterns, 183 infrastructure-as-code rules and 100 container rules, on the repositories in scope. You watch the scan run; you do not get the result by email.

  • Triage

    We turn raw output into a findings list you can defend

    The same flaw seen by two scanners becomes one finding with two sources. What you mark as accepted or false positive stays marked on the next scan, because the finding identity does not use line numbers.

  • GRC

    We map findings to the framework your client is audited against

    ISO/IEC 27001:2022 with 93 controls, SOC 2 with 47 criteria and OWASP SAMM v2 with 90 activities, with the confidence of each suggestion recorded for you to confirm or reject. Evidence carries an expiry date, and expired evidence stops supporting its control. These are catalogues loaded into the product, not certifications we hold. We hold neither ISO 27001 nor SOC 2.

  • Report

    We draft the report; you sign it

    The executive report comes out written — summary, risks by impact, what is in good shape and a 90-day plan — and is reviewed with you inside the workspace. The signature is yours.

Limits

What we do not do

  • We do not place permanent staff

    No recruiting and no permanent placement. If what you need is to hire someone onto your payroll, it is not us — and it is not what we are building.

  • We do not sell a calendar

    There is no "so many days a week". If the purchase needs a person appearing on a schedule, this model does not serve you, and saying so now costs less than finding out in month two.

  • There is no deliverable outside the product

    The document is not the product, and it comes out as a PDF. Not Word, not Excel.

  • The platform is not live yet

    Infrastructure is being rebuilt. There is no signup, no contracting and no billing today — and you pay for nothing before it exists.

Next step

Tell us which environments you want covered and we will tell you the scope.

A technical conversation with the person who wrote the code. No slide deck, and no proposal attached.

Talk to the engineer