Pentest for Health Insurers
Security audit on member portals, TISS integrations and telemedicine platforms.
Why now
The real pain
Health insurers handle ultra-sensitive data (ICD codes, history, exams) of millions of members. A breach can trigger ANS fines, LGPD penalties and class actions — plus an irrecoverable loss of credibility.
Applicable regulation
/attack-surface
Vectors we test in health insurers
Every engagement is designed for your environment. The points below are part of our standard playbook for this sector — final scope is adapted to your stack and contract.
Member portal
Unauthorized access to ID cards, exams and procedure authorizations of other users.
Mobile app
Static and dynamic analysis of iOS/Android app, certificate pinning, local storage.
TISS API
Audit of XML/REST integrations with providers and digital signature validation.
Telemedicine
Privacy of video consultations, prescription storage and medical records.
Provider network
Network provider portal testing and data segregation between providers.
/methodology
Genuinely manual pentest
Automated scanners find what's documented. Real attackers find what isn't. 90% of the work is manual — performed by specialists holding OSCP, CISSP, CRTO and GPEN.
01 · Reconnaissance
Target mapping, OSINT, footprint, sector-specific threat modeling.
02 · Discovery
Deep enumeration, complementary scanning, manual exposure identification.
03 · Exploitation
Manual validation with controlled PoC, finding chaining, escalation.
04 · Report
Executive + technical, step-by-step replication, mapped to applicable regulation.
/why-trust
Who has trusted our work
Experience in environments regulated by ANS and adherence to supplementary health regulations.
Technical assessment recognized in highly regulated, mission-critical environments — the pentest that finds what nobody had found before.
Douglas Lopes
Founder · CEO · intrus.io
/faq
FAQ — Health Insurers
Do you cover the TISS standard?
Yes. We assess TISS forms, digital signature integrity and security of insurer-provider communication.
Can pentest be done without affecting operations?
Yes. We work with a homologation environment mirrored from production and agreed windows for tests that touch the live environment.
/contact
Ready for a serious pentest in health insurers?
Schedule a confidential meeting. Within 48h we'll send a proposal with scope, timeline and pricing.