Initial report
Needs attention
- Asset
- gateway.example
- Finding
- TLS configuration needs hardening
- Proposed action
- Update configuration and verify
- Condition
- Approval and maintenance window
NODO 1 (N1) · AUTONOMOUS SECURITY & COMPLIANCE OPERATOR
Find it. Fix it. Prove it.
Nodo 1 (N1) brings IT support, cybersecurity and compliance into one operator. It detects risk, coordinates and executes authorized remediation, verifies the result and documents the evidence your organization needs to earn enterprise trust.
Trust is the outcome. Execution is the difference.
See plans and pricing
Nodo 1 (N1) console, full size
ONE SOFTWARE · THREE SCOPES
From resolving a ticket to hardening your infrastructure.
Three operational problems, one operator. N1 Security finds the risk; N1 Compliance turns it into hardening, verification and evidence. N1 Support keeps day-to-day operations moving.
/01
N1 Support
- The problem
- Repeated tickets consume your IT team’s time.
- What N1 does
- Diagnoses tickets and executes support tasks on authorized devices, with policies and approval based on risk.
- What you receive
- Resolved cases and recorded actions.
/02
N1 Security
- The problem
- You do not know what is exposed or which risks are real.
- What N1 does
- Assesses exposure, reviews configurations and orchestrates Blue Team and Red Team testing within the authorized scope.
- What you receive
- Findings, reports and a prioritized plan.
/03
N1 Compliance
- The problem
- Finding a flaw does not harden infrastructure or prove it was fixed.
- What N1 does
- Evaluates reports, remediates configurations and scans again to document what changed and how it was verified.
- What you receive
- Verified hardening and evidence for your controls.
The scope is agreed with you. Actions with material production impact require human supervision and a maintenance window when appropriate.
N1 COMPLIANCE · CONTINUOUS OPERATIONS
The finding is the start. Hardening is the work.
N1 takes security reports, connects to authorized infrastructure, discovers configurations and relates findings to applicable controls. It proposes remediation, executes authorized changes, verifies them with a new scan and documents the result. Successive reviews help maintain that posture.
INTERACTIVE WALKTHROUGH · LOCAL DEMONSTRATION
From technical risk to a provable fix.
Explore remediation that affects production. These buttons only change this example: they do not connect to infrastructure or execute real actions.
DETECTED
The scan identifies a TLS configuration that needs remediation.
PLAN GENERATED
N1 identifies the asset, proposes the change and assesses its impact.
WAITING FOR APPROVAL
The change may restart a service. N1 waits for approval and the agreed maintenance window.
APPROVED
In this example, an owner authorizes the plan for the agreed window. Execution remains bound to that scope.
REMEDIATING
N1 applies the change through the authorized interface and records the action and its result.
VERIFIED
N1 scans the asset again and compares the result with the initial finding.
EVIDENCE RECORDED
The follow-up report preserves the before and after states, authorization and verification.
- Example asset
- gateway.example
- Proposed change
- Update the TLS configuration
- Impact
- Potential service restart
- Window
- Agreed with the production owner
Production requires human judgment
The change may restart a service. N1 waits for approval and the agreed maintenance window.
Connect within scope. Execute with permission.
Authorized infrastructure
N1 connects to environments such as AWS and Google Cloud Platform using the credentials and permissions the customer enables for the agreed scope.
The appropriate interface for each change
It can act through APIs, CLI, SSH and tools in the authorized environment. Available mechanisms and changes depend on the asset, permissions and configuration.
A configuration change cannot close every gap. Policies, ownership, risk decisions and approvals require human involvement. Changes that depend on development or third parties are planned separately.
N1 EVIDENCE ENGINE
Every action leaves evidence.
The follow-up report shows what was fixed, how it was done and what the new assessment confirmed. It also preserves what remains open. Your team can demonstrate the work to customers, internal stakeholders and auditors.
ILLUSTRATIVE COMPARISON · DEMONSTRATION DATA
Follow-up report
Technical fix verified
- What changed
- Configuration updated on the authorized asset
- How it was done
- Change applied according to the approved plan
- How it was verified
- New scan of the remediated scope
- What remains open
- Organizational review and approval
Traceability that answers questions.
- Finding and affected asset
- Source and time of detection
- Before and after states
- Plan and authorization
- Executed actions and results
- Follow-up verification
- Evidence reference
- Related applicable control
Be ready to prove it.
- Scope
- Approved policies
- Risk register
- Statement of applicability
- Controls
- Technical evidence
- Internal audit
- Management review
- Corrective actions
These are readiness package components, depending on the applicable framework. N1 supplies reports and technical evidence; organizational documentation requires context, human review, approval and versioning. The complete package is prepared with your team and Orbexs, rather than generated automatically by a scan.
GOVERNANCE OF EVERY ACTION
Autonomy within your rules.
N1 assesses impact before acting. Permission, risk and the operating window determine how each change executes. Reversibility alone does not make an action low risk.
LOW RISK
Execution under policy
Tasks allowed by predefined policies can execute and be verified without individual approval.
MEDIUM RISK
Authorization under the rule
Scope and authorization rules determine whether N1 can execute or must escalate before acting.
HIGH RISK · PRODUCTION
Human approval required
Critical changes, service restarts and other impactful actions are reviewed with a human and coordinated with the agreed window.
Signed rules of engagement
Every assessment runs under rules signed with you: assets, windows and limits. Anything outside the authorized scope is blocked.
Deny by default
Every action needs a valid permission. Without one, it doesn't run: the block happens before acting, not after.
Human in control
Higher-impact actions ask for your approval. Denying is as easy as approving, and both decisions are logged.
Verifiable sealed log
Every step is recorded, and the report includes an integrity check that reveals any later alteration.
N1 SECURITY · AGENTIC CYBERSECURITY
Understand exposure. Prove risk with permission.
An external diagnostic opens the conversation. Tests that interact with infrastructure and offensive validation are agreed separately, with explicit scope and authorization.
Blue Team
Starts with external fingerprinting: DNS, subdomains, DMARC, SPF and DKIM records where applicable, and public exposure signals. HTTPS and TLS checks are scoped according to how they interact with the asset.
Passive reconnaissance: public sources without testing defenses. Low-impact active checks require an authorized scope; they are not described as passive or as pentesting.
Red Team
Assists and orchestrates authorized intrusive testing to demonstrate real vulnerabilities on agreed assets. Each finding is documented with severity, evidence and a recommendation.
ROE — Rules of Engagement: authorization, permitted assets, windows, actions, restrictions and traceability. Material impact requires human approval.
Identify
Autonomous agents and Orbexs specialists find what is truly exposed and test it with authorization, without extracting data. Every finding comes with its proof, its severity and a recommendation.
Remediate
We don't stop at the report: we close the exposures alongside your team and strengthen configurations and controls, within the agreed scope and timeline.
Verify
We test the fixes again to confirm the exposure no longer reproduces within the assessed scope.
Demonstrate
Every action and every finding is recorded with verifiable evidence, ready to show your posture to your leadership, your clients or an auditor.
What we assess
Exposed credentials
Passwords and access keys published where they shouldn't be.
Misconfigured services
Whatever was left open or on factory settings.
Interfaces exposed to the internet without protection
Entry points to your systems that answer anyone.
Injection flaws in applications
Forms and applications that accept commands they should never run.
Encryption and security headers
Whether your sites protect what travels between the browser and your servers.
Email authentication
Whether anyone can send email pretending to be your organization.
Content management systems
Sites built with WordPress and similar tools, with their plugins.
Attack surface and subdomains
Everything your organization exposes to the internet, including what nobody remembers.
This is how every finding arrives: with its severity, proof that the risk is real and a record that no business data was accessed.
Access credential published on the client's public website.
- Severity
- High
- Proof
- Access confirmed
- Business data
- Not accessed
Sealed evidence · valid chain
A TOUR OF THE CONSOLE
What N1 does, in plain view.
The main screen of the console brings together cases, the status of your devices and the assessments under way. Walk through it one area at a time.
Activity
Every case is followed until it is closed: created versus resolved, day by day.
Traffic light
The status of devices, cases and approvals, at a glance.
Ticket status
What is in progress, what awaits your approval and what is already closed.
Recent cases
Every assessment, with its status and its findings.
AGENTIC SUPPORT
N1 Support. IT support that acts.
Receives tickets, diagnoses issues and executes tasks on Windows, macOS and Linux within the authorized scope. It goes beyond suggesting steps: it applies permitted fixes, verifies the result and records the work. Critical changes escalate to a person.
How it resolves a case
The request comes in
In plain language, with no forms or codes.
Classifies impact and permissions
Assesses risk and authorization rules before deciding how to act.
Executes under policy
Permitted low-risk tasks execute and are verified. Reversibility does not replace authorization.
Anything sensitive, with your approval
It asks for permission with context. Without your approval, it doesn't proceed.
What it resolves
- Cache cleanup and troubleshooting
- Software installation and validation
- Driver installation
- Print queue cleanup
- Connectivity issues
- Device status and storage
With a safety net
Before and after state
Records state and verifies the result. Recovery or rollback is planned according to the task and what the environment supports.
Even if the cloud goes down
It combines rules and artificial intelligence: if the artificial intelligence is unavailable, it keeps resolving with its rules.
At night, too
It picks up open cases and resolves them at any hour, without anyone having to push them.
On several devices at once
It connects to the devices in your operation and resolves on several at once, with a record for each one.
RESULTS IN REAL ENVIRONMENTS
We identify. We fix. We test again.
What the assessments Orbexs has already run leave behind, with sealed evidence and within an authorized scope.
- offensive assessments with sealed evidence
- +30
- technical findings identified and catalogued
- +500
- data exfiltrated during testing
- 0
- of actions within an authorized scope
- 100%
Aggregate figures from the assessments Orbexs has run in real environments.
Cases with anonymized clients
From finding to closure: what we found, what we did and how it ended up.
Technology and health
External surface
Before
Publicly exposed services and assets, with configurations that widened the attack surface.
What Orbexs did
Reconnaissance, validation of each exposure and remediation alongside the client's technology team.
After
Findings fixed and a strengthened surface.
Legal sector
Infrastructure
Before
Controls and configurations that needed strengthening.
What Orbexs did
Defensive and offensive assessment, plus strengthening of configurations and controls.
After
Controls reinforced and fixes verified in a second assessment.
Applications and services
Before
Technical findings with potential impact on the security of the environment.
What Orbexs did
Identification, technical remediation and a retest of the fixes.
After
Findings fixed, with evidence from the follow-up validation.
DISCOVER · REMEDIATE · OPERATE
An entry point. An ongoing cycle.
Start by understanding your exposure, agree what to fix and maintain security operations with evidence. These are ways to work with the same N1, according to the scope you need.
Discover
External diagnostic and initial assessment. Active and intrusive tests are agreed under specific authorization.
What you receive
- Report of the discovered surface and findings
- Prioritization and recommendations
- Proposed scope for the next step
Remediate
Hardening of authorized infrastructure, with impact assessment, supervision when needed and follow-up verification.
What you receive
- Change plan and required approvals
- Remediation within the agreed scope and timeframe
- New scan and comparative report
Operate
Continuous security and compliance operations: successive reviews, authorized fixes and evidence to maintain and demonstrate your posture.
What you receive
- Periodic assessments and tracking of open items
- Hardening and updated technical evidence
- Assisted readiness for independent assessments
Clear rules in every engagement
- Signed scope. Assets, windows and limits are defined in the rules of engagement.
- Bounded remediation. We support the fixes within the agreed scope and timeline.
- Retest included. We verify the fixed findings within the assessed scope.
- Dependencies handled separately. Changes that require development work or third parties are planned on their own.
ORBEXS · THE HUMAN LAYER
N1 execution. Human judgment. Customer authorization.
Orbexs supports security and compliance operations: prioritizing work, reviewing plans, coordinating production windows and interpreting evidence. Your team retains its decisions and approvals.
- Risk prioritization and plan review
- Coordination of owners, approvals and maintenance
- Readiness and documentation support with human review
- External assessments and audits with independent judgment; certification belongs to the certification body
PLANS · ONGOING SECURITY AND SUPPORT
A plan for every stage of your security.
Start with a free diagnostic and choose how much support you need. Clear pricing, a report with concrete actions every month, and a person who reviews what N1 finds.
Companies of 20 to 150 people
Vigía
USD 300/month
≈ COP 1.2 M per month
To know, every month, what an outsider sees of your company from the internet and what is worth closing first.
What it includes
- Continuous monitoring of your external exposure
- Monthly report with concrete, prioritized actions
- Reviewed by a person, not just an automated PDF
For having it fixed, not just knowing
Guardián
Recommended
USD 750/month
≈ COP 3.0 M per month
Everything in Vigía, plus time from our team to fix what the report points out.
What it includes
- Everything in Vigía
- Up to 8 hours a month of remediation
- Verification of every fix made
Banking, fintech and software selling to the US
Cumplimiento
From USD 1,500/month
≈ COP 6.0 M per month, from
For those who must answer for their security to customers, banks or auditors.
What it includes
- Remediation of whatever the scope requires
- A scoped penetration test, under signed rules of engagement
- Help with the security questionnaires from your customers and banks
Values in USD before taxes; COP equivalent for reference.
How to start
- Setup. Each plan has a one-time setup fee. In Vigía it is waived if you sign for a year.
- Paid 30-day pilot. This is the entry point we recommend. It carries a money-back guarantee, and if you continue it is credited to your contract.
Remediation by project
If you would rather fix what we found once, we quote by project. The price depends on size and on your infrastructure, on your own servers or in the cloud.
Project S
USD 600 – 1,200
A few fixes with a clear scope and simple infrastructure.
Project M
USD 1,500 – 3,500
Several areas to fix, or a mixed infrastructure.
Project L
USD 4,000 – 9,000
A broad infrastructure, with several sites or systems.
Every project ends with a before-and-after report and a new verification 30 days later.
EXPOSURE DIAGNOSTIC · NO COST
Start by seeing your external exposure.
It is 100% passive: we look only at what is already public, without testing access or touching your systems. We do it only with the authorization of the domain owner.
We work aligned to a framework for the agreed scope. Certifications and reports (ISO 27001, SOC 2, the PCI scan) are issued by accredited, independent third parties; we help you prepare.
WHERE IT RUNS
It runs where your risk lives.
Support, security and compliance work within a deployment and scope agreed with you.
ON YOUR INFRASTRUCTURE
Inside your network
The engine works from inside your network and the evidence stays within your perimeter. Any use of external services is defined with you in the scope.
IN THE CLOUD
A dedicated environment per client
A cell of its own for your organization: N1 shares no instance or data with other clients.
WHO IT IS FOR
Build like a startup. Prove like an enterprise.
Startups selling to enterprises
Enterprise buyers request evidence of access, incident, risk and security controls. N1 helps turn operational work into a demonstrable posture.
CTOs and engineering teams
A path from finding to authorized change, with verification and traceability, while retaining control of production.
CISOs and security owners
Prioritized findings, coordinated remediation and evidence of what was fixed and what remains open.
Organizations handling sensitive data
A clear scope for hardening configurations and demonstrating the work to stakeholders.
Companies preparing for an audit
Operational support for progressing toward independent assessment, alongside your organization’s professionals and owners.
Clear answers about scope.
What N1 does, what requires authorization and what belongs to an independent assessment.
Nodo 1 (N1) is one software with three scopes: Support for IT tasks, Security for assessments and reports, and Compliance for hardening, remediation and evidence. The contracted scope defines how each part participates.
It evaluates security reports, connects to authorized infrastructure using customer-enabled credentials and remediates configurations within scope. Complex changes or material impact require supervision and agreed windows. It then scans again and documents what was fixed, how and with what result.
No. Passive reconnaissance uses public information. Low-impact active checks are scoped and authorized according to their interaction with assets. Intrusive and offensive testing require specific authorization and ROE defining assets, windows, actions and restrictions.
Low-risk tasks can execute under predefined policies. Other tasks follow the scope’s authorization rules. For high risk or material production impact, N1 requires human approval and coordinates the maintenance window when appropriate.
No. N1 helps with hardening, technical control alignment and evidence to prepare for assessments such as ISO 27001 and ISO 42001; an independent certification body determines certification. SOC 2 Type II is an examination with a report issued by an independent auditor. Readiness also requires organizational processes, documentation and responsibilities. N1 does not guarantee certification or replace the auditor.
No. Orbexs can support technical and organizational measures related to GDPR. Remediation and reports contribute evidence; they do not independently establish complete compliance with legal data protection obligations.
Yes. It can support prioritization, review, documentation and coordination of windows and owners, as well as offer external assessments and audits with independent judgment. Certification and formal determinations belong to the authorized independent third party.
The control view on this page is conceptual and identified as the module’s evolution. Reports and technical evidence are part of current operations. Policies and the organizational package need your team’s input, human review, approval and version control; they are not presented as available automatic generation.
Only the authorization of the domain owner, which we verify before starting. The assessment is fully passive: we look at what is already public on the internet and run no tests against your systems.
Because the first month involves work that is not repeated: verifying your domains, building the baseline and, in Guardián and Cumplimiento, prioritizing remediation or analyzing gaps against the framework. In Vigía it is waived with an annual contract.
Guardián and Cumplimiento hours do not roll over from one month to the next. If you need more in a given month, we quote them separately before doing anything.
Before starting, we agree in writing on the scope and the success criteria. If at the end of the pilot you do not see value, we refund what you paid; if you continue, that amount is credited to your contract.
No. Prices are in US dollars and before taxes; the Colombian peso equivalent is for reference and may vary with the exchange rate.
From finding risk to proving remediation.
Schedule a technical session to see N1 in action and define an external diagnostic within an agreed scope. Then decide what to fix and how to maintain it.
See N1 in action