Prove it or don’t report it
Every finding is verified with reproducible evidence before it is recorded. We don’t hand over generic lists.
NEWAI research guides and good practices→Before they do.
Penetration testing & cloud security · Mexico
Before they do.
We find the gaps.
Multi-source reconnaissance, evidence-based verification and executive reporting. We prioritize verifiable evidence and distinguish observations from confirmed findings.
MITRE ATT&CKOWASPNIST CSFISO 27001ISO/IEC 42001:2023ISO/IEC 27090:2026
7+
Years of experience
in cybersecurity
in cybersecurity
12
Vulnerability classes
covered
covered
100%
Findings with
reproducible evidence
reproducible evidence
AWS
AWS-certified
team
team
OpenAI
Certified team
in OpenAI
in OpenAI
Anthropic
Certified team
in Anthropic
in Anthropic
Industries we serve
FintechManufacturingHealthcareRetailLogisticsConstructionStartups
What we do
Three fronts.
One standard.
01
Services
Pentesting, multicloud audit and executive reports backed by reproducible evidence.
See services →02Kirux
The platform that connects testing, operations and cloud posture to the findings that matter.
Explore Kirux →03Research
Studies with video, charts and a PDF paper. Every figure with its source and its limits.
Explore research →Sample reportEvidence,
Evidence,
beyond an alert.
Here is what your report looks like. Every finding includes its severity, status and supporting evidence.
Real severityCited evidenceVerified ✓
- Executive Summary
- Recon
- Findings
- Evidence
- Cloud AWS
- Remediation
2Critical
5High
8Medium
100%With evidence
FindingSeveritySourceEvidenceVerified
Leaked credentials (infostealer)CRITBreachesverified record✓
Outdated TLS protocolHIGHHandshakeTLS version✓
Exposed development subdomainMEDLive hostsstatus 200✓
SPF softfail instead of hardfailMEDDNSdig TXT✓
Excessive IAM privilegesHIGHAWSIAM policy✓
Latest from Research
Govern and protect AI.
NEWGuides and good practices · 19 Oct 2026
ISO/IEC 42001:2023 and ISO/IEC 27090:2026: questions to research, practices to apply and evidence to review. A NullGhost guide and manual.
How we think
Evidence, scope
and judgment.
Observed is not confirmed
We distinguish what was observed from what was confirmed and state the validation level of every finding.
Authorization first
Nothing starts without an explicit scope and permission. To begin: external, non-destructive, read-only recon.
Judgment stays with the team
AI expands what we can connect and build. Professional review remains part of the service.
Commercial partner
Klipp
Klipp is a commercial partner of NullGhost. Its offering brings together cybersecurity consulting, training, professional services and managed services.
Explore Klipp ↗What would we find on your domain?
A free initial external review. Summary in 24–48 hours.