Offensive security · Mexico
We attack so that no one else can.
We emulate real adversaries, under contract and Rules of Engagement, so your team strengthens its defenses on evidence, not assumptions.
Services
Adversary by contract. Ally by purpose.
Every engagement is defined by its scope and RoE. We deliver verifiable findings and a prioritized remediation path.
- 01
Red team
End-to-end adversary emulation: initial access, lateral movement and business objectives, measuring detection and response.
- 02
Pentest
Web and mobile applications, APIs, internal and external infrastructure, and cloud. Documented, reproducible methodology.
- 03
Purple team
Collaborative exercises with your SOC: we execute techniques, validate telemetry and tune detections in real time.
- 04
Social engineering
Simulated phishing and vishing campaigns, run from dedicated per-engagement infrastructure with prior deconfliction.
- 05
Compliance assessments
Testing aligned to CNBV, PCI DSS and ISO 27001, with evidence ready for your auditor and regulator.
- 06
Retest and enablement
We verify every remediation and transfer knowledge to your teams so the improvement lasts.
Approach
We speak two languages: the regulator's and the attacker's.
Nergal was founded in Mexico by practitioners of hacker culture and free software, with the discipline of financial-sector compliance.
Most firms are fluent in only one of the two. We translate every offensive technique into a business risk your board, your auditor and your regulator can act on.
- CNBV
- PCI DSS
- ISO 27001
- MITRE ATT&CK
- OWASP
- PTES
- Rigor
- Findings stated as facts, with evidence and reproduction steps.
- Discretion
- Client data handled on a need-to-know basis with minimal retention.
- Legitimacy
- Nothing outside a signed contract, scope and RoE. No exceptions.
- Transfer
- We credit your defenders and leave them capabilities, not just a report.
Process
One engagement, end to end.
- NRG-2026-014 · 01
Scope and RoE
We define objectives, limits, windows and deconfliction channels. All in writing.
- NRG-2026-014 · 02
Reconnaissance
We map the attack surface and assumptions before touching a single system.
- NRG-2026-014 · 03
Execution
We operate within the agreed window, with continuous communication through one official channel.
- NRG-2026-014 · 04
Report
Executive summary, findings by severity, evidence and prioritized remediation.
- NRG-2026-014 · 05
Retest
We validate fixes and close the loop with your team.
Deliverables
Severity that reads the same on screen, in grayscale and on paper.
Every finding is rated, backed by evidence and paired with an actionable recommendation.
- Critical
- High
- Medium
- Low
- Informational
| ID | Finding | Severity |
|---|---|---|
| F-01 | Reused credentials on corporate VPN | Critical |
| F-02 | SQL injection in balance-inquiry API | High |
| F-03 | MFA policy not enforced on service accounts | Medium |
| F-04 | Missing HTTP security headers | Low |
| F-05 | Server version disclosed in responses | Informational |
Contact
Let's talk about your next engagement.
Tell us what you need to protect. We reply within one business day with an initial scope proposal.
- Commercialcontacto@nergal.red
- Operations (live engagements)ops@nergal.red
- Vulnerability disclosuresecurity@nergal.red