firstsecurity.com.br

What It Is

First Security is an offensive cybersecurity service provider based in Brazil. Its core offerings include professional penetration testing, Red Team, Purple Team, and Pentest as a Service (PTaaS). According to its website, it has completed 500+ penetration tests, has been operating for more than 8 years, serves 15 industries, and positions itself around “finding vulnerabilities before real attackers do.”

Core Capabilities and Protection Coverage

Its service coverage is fairly broad, including Web, API, Mobile, Cloud, infrastructure, Active Directory, AI/LLM, wireless, IoT/OT, and red team assessments. In terms of methodology, it explicitly references PTES, OWASP WSTG/MASTG, NIST SP 800-115, and MITRE ATT&CK. Reports are split into executive and technical versions, including CVSS severity ratings, PoC, reproducible evidence, and prioritized remediation recommendations, which is practical for both audits and engineering remediation.

Deployment, Management, and Compliance

Delivery is primarily remote. Web, API, cloud, mobile, and most network testing can be performed remotely, while internal networks can be accessed via VPN or Jump Server. For wireless, physical segmentation, IoT/OT, or high-security environments, on-site service is also available. On the compliance side, the reports claim to cover requirements such as LGPD, PCI DSS, ISO 27001, BACEN, and SOC 2, and can provide annual compliance summaries, making it suitable for companies that need audit-ready materials.

Pricing and Service Model

Standard projects are quoted based on scope. The website offers a free budget request and promises a response within 24 business hours, but does not publish specific pricing. PTaaS is offered on an annual contract basis, with agreed hours or credits used over the course of a year. It includes priority scheduling, a dedicated account manager, unlimited retesting, and a fixed annual budget, and claims to save 20% to 30% compared with an equivalent volume of one-off projects.

Pros, Cons, and Best Fit

Its strengths are comprehensive offensive and defensive service coverage, clear methodologies, team certifications including OSCP, OSWE, OSEP, and CRTO, and free retesting after high-risk and critical vulnerabilities are fixed. The downsides are limited pricing transparency, no disclosed information on customer portal, API, SIEM, or ticketing system integrations, and no details about cross-border delivery or Chinese-language support. It is better suited to mid-sized and large enterprises in Brazil with multiple systems, frequent releases, compliance audit needs, or an annual security budget.

Access from China and Alternatives

Its accessibility from mainland China, payment methods, and contract support are not disclosed, so these remain unknown. For Chinese companies, if the main needs are domestic compliance, MLPS, or local response, it would be safer to prioritize local penetration testing providers, cloud vendor security services, or security consulting firms with proven cross-border delivery capabilities.