Pentest for Public Sector and Government
Offensive security in federal, state and municipal agencies, autarchies and state-owned enterprises.
Why now
The real pain
Government is a target of hacktivism, nation-states and organized crime. Citizen, tax, HR and procurement systems halt the state's functioning. Public-sector LGPD (Law 14.460/2022) holds the civil servant accountable, with fines for the entity.
Applicable regulation
/attack-surface
Vectors we test in public sector & government
Every engagement is designed for your environment. The points below are part of our standard playbook for this sector — final scope is adapted to your stack and contract.
Citizen portal
gov.br, state e-gov, integration with identity bureau.
Tax systems
SEFAZ, ITR, IPTU, ISS, credit fraud.
Procurement and public bidding
Electronic bidding, electronic procurement exchange.
Public payroll and HR
Civil servant system, payslip, salary line fraud.
Public safety
When applicable, Civil/Military/Federal Police systems.
/methodology
Genuinely manual pentest
Automated scanners find what's documented. Real attackers find what isn't. 90% of the work is manual — performed by specialists holding OSCP, CISSP, CRTO and GPEN.
01 · Reconnaissance
Target mapping, OSINT, footprint, sector-specific threat modeling.
02 · Discovery
Deep enumeration, complementary scanning, manual exposure identification.
03 · Exploitation
Manual validation with controlled PoC, finding chaining, escalation.
04 · Report
Executive + technical, step-by-step replication, mapped to applicable regulation.
/why-trust
Who has trusted our work
Caixa Econômica Federal — state-owned enterprise. Civil Police, Military Police, Federal Police and CREA.
Technical assessment recognized in highly regulated, mission-critical environments — the pentest that finds what nobody had found before.
Douglas Lopes
Founder · CEO · intrus.io
/faq
FAQ — Public Sector & Government
Do you work with public safety agencies?
Yes. We engage with Civil Police, Military Police and Federal Police.
Do you serve public bidding and have clean CADIN?
Yes. Company qualified for public bidding, CADIN and other registries up to date.
/contact
Ready for a serious pentest in public sector & government?
Schedule a confidential meeting. Within 48h we'll send a proposal with scope, timeline and pricing.