Question 1

What does DM11 do?

Accepted Answer

We are an AI Trust and IT Risk Protection consultancy. We build AI governance, compliance programs (ISO 27001, PCI DSS, SOC 2, LGPD, BACEN), offensive and defensive cybersecurity, on-demand Security Office and business continuity. All of it runs on our own methodology, delivered by certified specialists.

Question 2

How long has DM11 been in the market?

Accepted Answer

The company started in 2009, carrying almost 30 years of cybersecurity project experience from our executive partner. Since then we have delivered more than 5,300 projects, protected more than 2 million assets and detected more than 900,000 vulnerabilities in 2025 alone.

Question 3

What sets DM11 apart from other consultancies?

Accepted Answer

Three things. We do not sell tools, so the recommendation you get is technical and never commission driven. Our team holds the international certifications the market demands. And we have been preparing clients for the requirements of banks, the Big Four and major digital retail players for fifteen years.

Question 4

Does DM11 resell security tools?

Accepted Answer

We resell nothing. That is a deliberate business decision. When we assess your environment and recommend a path, you know the technical analysis is the only criterion behind that recommendation.

Question 5

What certifications does the DM11 team hold?

Accepted Answer

The main ones include CISA and CGEIT (ISACA), CEH (EC-Council), ISO/IEC 27001 Lead Auditor from BSI, PCI QSA, DPO and PDPP from EXIN, COBIT 5, ITIL, PMP and PRINCE2 Foundation. On top of those, the team holds credentials in penetration testing, threat intelligence and digital forensics.

Question 6

How does the day-to-day engagement work?

Accepted Answer

Every project has assigned specialists and a reporting routine agreed with you at the start. You get reports with a prioritized action plan and live sessions to walk through the results, not a document dropped in your inbox.

Question 7

Does DM11 work with companies of any size?

Accepted Answer

We serve clients from agribusiness to financial services, across a wide range of sizes. The strategy is tailored by size and sector, precisely because what makes sense for a regulated financial institution is not what makes sense for a fast-growing company. The right scope comes out of the initial assessment.

Question 8

Do you serve companies outside São Paulo?

Accepted Answer

Yes. Our office sits in the Berrini area of Brooklin, São Paulo, but projects run remotely or on site depending on what the work requires. Where your operation is located does not limit what we can deliver.

Question 9

How does a project with DM11 start?

Accepted Answer

It starts with a conversation to understand your context, your moment and what is putting pressure on you: an audit, a demanding client, a regulator, an AI rollout. Then we propose an assessment that sizes the real scope. Only after that do we talk about a work plan.

Question 10

Who runs the projects: your own team or subcontractors?

Accepted Answer

Our own team. The pentesters are in-house and certified, with zero subcontracting, and we run our own Cyber Intelligence Center. That matters because whoever enters your environment answers directly for confidentiality and method.

Question 11

How does DM11 handle confidentiality?

Accepted Answer

Confidentiality is the condition our work exists on. In digital forensics, for example, we deliver reports fit to support court proceedings, with absolute secrecy over the material analyzed. The same discipline applies to any project: access limited to what is strictly necessary, and evidence handled with full traceability.

Question 12

What languages does DM11 work in?

Accepted Answer

We work in Portuguese and produce documentation, in both Portuguese and English, for the international contexts our clients have to answer to, such as SOC 2, ISAE 3402, GDPR, TISAX and the EU AI Act. If your headquarters or your auditor requires material in another language, we align that in the scope.

Question 13

What is AI Trust?

Accepted Answer

It is the confidence your company needs in order to grow using AI. In practice, it means bringing governance, risk management, regulatory compliance and AI application security into a single program. It was the natural next step for a firm already doing IT GRC, cybersecurity and business continuity.

Question 14

Why govern the use of AI in my company?

Accepted Answer

Because your company already uses AI, with or without a policy. Without governance, biased models and hallucinations inside critical processes make decisions and get them wrong at scale, and autonomous agents operate with no clear boundaries. You structure this now, or a regulator, a client or an incident structures it for you.

Question 15

What is ISO/IEC 42001?

Accepted Answer

It is the first certifiable international standard for artificial intelligence governance. It defines the AI Management System (AIMS): roles, policies, approval flows for use cases and human oversight, all documented and auditable. We structure your compliance from the initial assessment through certification readiness.

Question 16

Does the EU AI Act apply to my Brazilian company?

Accepted Answer

It depends on where you operate and who you sell to. Companies active in Europe or supplying AI systems to the European market fall within scope. We run a gap assessment against the EU AI Act and classify your systems by regulatory risk category, so the answer is precise for your case.

Question 17

Where does AI regulation stand in Brazil?

Accepted Answer

The Brazilian AI legal framework is moving through Congress as Bill 2338/2023, and the ANPD, Brazil's data protection authority, has widened its supervision over automated decisions and personal data in AI. Companies that structure now avoid the rushed compliance scramble, which always costs more and delivers less.

Question 18

What is an AI Risk Assessment?

Accepted Answer

We inventory every AI use in the company, official and unofficial, and classify each one by regulatory, security, privacy and reputational risk. You get a prioritized map with a treatment plan and indicators you can take to the board. We apply the same method standard that made oitenta20® work.

Question 19

What is shadow AI and why should I worry about it?

Accepted Answer

It is employees using generative AI tools with internal data and no oversight at all. Every prompt can carry personal data, trade secrets or intellectual property outside the company. The AI Risk Assessment inventory is built to surface exactly those unofficial uses.

Question 20

What is prompt injection?

Accepted Answer

It is an attack where malicious instructions are placed in the model input to divert the application's behavior, bypass restrictions or extract information that should stay protected. We test for it in penetration tests of AI applications and LLMs, alongside jailbreak techniques.

Question 21

What other security risks do LLM applications bring?

Accepted Answer

AI systems create attack surfaces that did not exist before: training data poisoning, model extraction and sensitive information leaking through the responses. We cover those vectors with penetration testing, MLSecOps across ML pipelines and model supply chain analysis (AI/ML BOM).

Question 22

What is data poisoning?

Accepted Answer

It is the deliberate contamination of the data used to train or feed a model, so its decisions come out distorted later. The damage shows up in production, when the model is already deciding. We run data poisoning and model extraction detection inside our AI cybersecurity practice.

Question 23

What is AI Red Teaming?

Accepted Answer

Adversarial testing run against your models, pipelines and generative applications, following references such as MITRE ATLAS and the OWASP Top 10 for LLM. We apply offensive and defensive methodology across the entire lifecycle, not just at launch.

Question 24

How do you audit bias and explainability in a model?

Accepted Answer

Models that make decisions about people have to account for those decisions. We assess bias and fairness in the models and in the training data, verify the explainability of automated decisions under article 20 of LGPD, Brazil's data protection law, and align with references such as the OECD AI Principles and UNESCO AI Ethics. The output is audit reports for regulators and stakeholders.

Question 25

Do I need a responsible AI use policy?

Accepted Answer

You do, and it only works if it is communicated and trained. We write the policy together with the responsibility matrix, set up the AI committee and the approval flows for use cases, then take it to the business in awareness tracks tailored by profile: legal, IT and business.

Question 26

When is the right time to start governing AI?

Accepted Answer

Before the question arrives from outside. Regulators, clients and boards are already asking for answers about AI use, and an AI Risk Assessment reveals in weeks what an incident would reveal in the worst possible way. If you cannot say how many AI systems run in your operation, that is your signal.

Question 27

What is IT GRC?

Accepted Answer

It is the discipline that brings technology governance, risk management and compliance into a single system. Instead of addressing each standard in isolation, you build controls that serve several requirements at once. Less internal effort, evidence reused, audits that stop being a surprise.

Question 28

What is ISO 27001 and what does DM11 do on that project?

Accepted Answer

It is the international standard for Information Security Management Systems, and in practice it is the credential that unlocks the most enterprise business in Brazil. We run it from assessment to certification: gap analysis, compliance plan, control implementation, risk management and audit preparation. After that we stay on for ISMS maintenance and continuous improvement, with BSI-certified Lead Auditors on the team.

Question 29

How long does ISO 27001 certification take?

Accepted Answer

It depends on the size of the scope, the current maturity of your controls and how available your team is to produce evidence. The gap analysis is what turns that question into a real schedule. Without it, any promised deadline is a guess.

Question 30

What is ISO 27701?

Accepted Answer

It is the privacy extension of the ISO 2700x family. It adds controls specific to personal data processing to your management system, which maps directly onto the requirements of LGPD and GDPR. It makes sense once privacy is already part of your commercial pitch.

Question 31

How does a PCI DSS project work and what is the QSA's role?

Accepted Answer

We assess the scope of your payment environment, run the gap assessment, implement the controls and cardholder data encryption, write policies and procedures, train the teams and support you through certification. The work is led by professionals holding the PCI QSA credential, qualified to assess compliance against the PCI Security Standards Council standard. In other words, the preparation is done by people who know the assessment criteria from the inside.

Question 32

What is the difference between SOC 2 Type I and Type II?

Accepted Answer

Type I attests to the design of controls at a specific point in time. Type II evaluates how effectively those controls operate over an observation period, which is far more demanding and is what large clients usually ask for. We support you throughout the Type II observation period.

Question 33

What is ISAE 3402?

Accepted Answer

It is an international assurance report on the controls of a service organization, frequently requested when your clients need to rely on your processes to close their own audits. We prepare the scope, the control design and the evidence collection so you reach the auditor without surprises.

Question 34

What do BACEN resolutions CMN 4,893 and BCB 85 require?

Accepted Answer

BACEN is Brazil's central bank. Financial and payment institutions need a formal cybersecurity policy, an incident response plan that includes notifying the regulator, and controls over contracting cloud processing and storage. We start by mapping which requirements apply to your institution specifically, implement the workstreams needed and keep compliance monitoring running continuously.

Question 35

What does an LGPD compliance project look like?

Accepted Answer

LGPD is Brazil's data protection law. The project runs from mapping data flows and defining legal bases to privacy and governance policies, mechanisms to handle data subject rights and team training. We integrate all of it into your security program instead of treating privacy as a parallel project.

Question 36

Do I need a DPO? Can I outsource it?

Accepted Answer

You can outsource it, but that is not always the best route. With DPO Backoffice®, your Data Protection Officer stays in-house, close to the business, and gains a team of digital law, cybersecurity and GRC specialists alongside them. It costs less than hiring and retaining a senior specialist, and the knowledge stays inside your company.

Question 37

How should we respond to data subject requests?

Accepted Answer

You need a defined process, not improvisation case by case. We implement the mechanisms to handle data subject rights and take care of the privacy routine: consent, incoming requests, incidents and the risks posed by processors and third parties.

Question 38

Why assess the security of my suppliers?

Accepted Answer

Because your suppliers are part of your risk surface, and the client auditing you will ask about them. We assess critical suppliers, review contracts and security clauses, standardize questionnaires and evidence, and monitor the ecosystem on a regular cycle.

Question 39

A client sent me a huge security questionnaire. How do I answer it?

Accepted Answer

That questionnaire is where a lot of deals stall. A well-built security dossier answers most of the questions before they arrive, with controls in place and evidence ready. We organize that base so due diligence stops being an obstacle and becomes an argument.

Question 40

How do I prepare for an audit?

Accepted Answer

Audits turn into crises when the evidence is produced the week before. We work on control design, continuous evidence collection and auditor readiness, using our own methodology and specialists who have sat on both sides of the table.

Question 41

Is being compliant the same as being secure?

Accepted Answer

It is not. Compliance proves you meet a set of requirements within a defined scope. Security is the real capacity to withstand an attacker, and that is only measured by testing: penetration tests, phishing simulations, crisis exercises. A mature program does both and uses each one to reinforce the other.

Question 42

Can one program cover several standards at once?

Accepted Answer

It can, and that is exactly how the cost of compliance comes down. Addressing each standard in isolation burns internal teams in endless evidence cycles. With NosConformes®, we map every audit and regulatory requirement into a single management point and take advantage of the overlaps between them.

Question 43

What is the difference between certification and compliance?

Accepted Answer

Compliance means implementing the controls and processes the standard requires. Certification is the attestation issued by an independent certification body after auditing that compliance. Many companies only need to be compliant to answer clients; others need the certificate to bid. We define which is which during the assessment.

Question 44

What is a security roadmap for?

Accepted Answer

It stops you from deciding investment by urgency. The Cybersecurity Strategy & Roadmap shows where you are, where you need to get to and the investment sequence that makes sense for your size and sector, with progress indicators for the board. Strategy comes before tooling.

Question 45

What is a penetration test and what is it for?

Accepted Answer

A pentest is a controlled attack on your environment, run by specialists, to find out how far a real intruder could get. Our team uses the same techniques attackers use, but within an agreed scope and with everything logged. What you get at the end is not a list of theories, it is proof of what is exploitable and the path to close each door.

Question 46

What is the difference between a pentest and a vulnerability scan?

Accepted Answer

A scan is automated and flags indications. A pentest validates those indications and goes further: business logic flaws, authentication bypasses and exploitation chains only surface when a professional thinks like an attacker. Those are precisely the flaws intruders prefer, because no tool sees them on its own. In practice we use both: automation for coverage, humans for depth.

Question 47

What are black box, grey box and white box pentests?

Accepted Answer

Black box simulates the external attacker who knows nothing about you. Grey box starts from limited access, like a regular user or a partner. White box hands documentation, source code and credentials to the testing team, which gives the deepest coverage per hour invested. The choice depends on what you want answered, and we define it with you before we start.

Question 48

How often should my company run a pentest?

Accepted Answer

If your last test is more than twelve months old, you are deciding in the dark. Beyond the annual cycle, test whenever something material changes: a new application in production, a cloud migration, a third-party integration or an architecture change. Companies that deploy frequently usually prefer the subscription model, with recurring tests throughout the year.

Question 49

How does a web application pentest work?

Accepted Answer

We follow OWASP methodology and go deep on authentication, authorization, business logic and data leakage. We test what the application does and also what it lets you do when someone runs the flow out of the expected order. The result comes with exploitation evidence and remediation guidance for the development team.

Question 50

Do you test APIs?

Accepted Answer

We test REST and GraphQL APIs. The focus is authentication, access control, exposing more data than needed and logic abuse, which is where APIs tend to fail without anyone noticing. Many companies protect the interface well and forget the API behind it answers anyone who knows how to call it.

Question 51

Are mobile apps in scope?

Accepted Answer

Yes, for Android and iOS. We analyze local storage, communication with the server, resistance to reverse engineering and the integration with backend APIs. An app is a binary in anyone's hands, so everything embedded in it should be treated as public.

Question 52

Do you test external networks, internal networks and wireless?

Accepted Answer

All three are part of our scope. On the external network we assess the full internet-facing surface. Internally we simulate what happens after someone gets in, including lateral movement and privilege escalation. On wireless we look at corporate and guest networks, with particular attention to segregation and authentication.

Question 53

How does cloud security assessment work?

Accepted Answer

We test configuration and exploitation across AWS, Azure and Google Cloud, following CIS benchmarks and Cloud Security Alliance practices. Cloud misconfiguration is among the leading causes of data leaks, and what was safe in the data center can be exposed the moment it moves. We also review identity, encryption and monitoring, because in the cloud the perimeter is the permission.

Question 54

What is a retest and is it included?

Accepted Answer

A retest validates that the fixes actually worked. Once your team addresses the findings, we go back to the same points and confirm they are closed. Retesting is included in our pentest projects and in every Ethical Hacker as a Service plan. A report without a retest is a diagnosis without a discharge.

Question 55

What is in the pentest report?

Accepted Answer

You get the vulnerabilities found with technical evidence, the criticality of each one and a prioritized action plan, not a raw list sorted by generic severity. There is an executive read for the board and the technical detail your IT team needs to fix things. We close with a results presentation session, so questions get answered by the people who ran the test.

Question 56

What are SAST and DAST, and how do they differ?

Accepted Answer

SAST analyzes source code at rest, looking for flaws in how the application was written. DAST tests the running application from the outside, the way an attacker would. Each sees what the other cannot reach, which is why we apply both. Your development team gets remediation guidance, and we can integrate the analyses into the development cycle.

Question 57

How does phishing simulation work, and does it expose employees?

Accepted Answer

We design realistic campaigns by department, role and exposure level, and measure who opened, who clicked and who reported. Nobody is exposed or punished: we work with influence and empathy, never with manipulation or fear. Every click becomes immediate training for that person, and the management report speaks in terms of groups and trends. Tracking is non-intrusive and respects privacy.

Question 58

What is vulnerability management?

Accepted Answer

It is the continuous process of identifying, prioritizing and tracking the remediation of flaws in your environment. The difference is in the prioritization: we map your assets, connect each one to the business processes it supports and rank by the real risk to you. A medium-severity flaw in a critical system can matter more than a critical one on an isolated server.

Question 59

Do you handle incident response and digital forensics?

Accepted Answer

We investigate incidents with collection, preservation and analysis of digital evidence, under absolute confidentiality. We reconstruct the event timeline, analyze devices, recover data and work to identify attribution. When the case goes to legal, we deliver a forensic report fit to support court proceedings.

Question 60

What is Cyber Threat Intelligence and what is it good for in practice?

Accepted Answer

It is threat intelligence applied to your context, not a generic indicator feed. We monitor actors, campaigns and exposures relevant to your sector, including credential leaks and misuse of your brand. Those external signals turn into defensive decisions before the attack, and help prioritize what to address first. We run our own Cyber Intelligence Center for this.

Question 61

Can a pentest disrupt or take down my operation?

Accepted Answer

The risk exists in any real test, which is exactly why it is planned. We agree on the execution window, the scope, the sensitive assets and a direct contact channel before any activity starts. Critical risks trigger an immediate alert rather than waiting for the final report. If an environment cannot tolerate downtime, we adjust the approach for that target.

Question 62

We found flaws in the test. What do we do now?

Accepted Answer

Start with the prioritized action plan in the report, which already orders the work by what reduces the most risk with the least effort. Our team supports yours in interpreting each finding technically and defining the fix, and we coordinate follow-up when you contract vulnerability management. Once fixed, we retest and you have closure evidence for the auditor and for the client who asks.

Question 63

What does contracting security as a Service mean?

Accepted Answer

You contract exactly the competence you need, at the right intensity, without the fixed cost of building an internal team. Instead of opening a role, waiting out the hiring process and hoping to retain the professional, you get senior specialists who are already trained. Building a complete security team takes years, and risk does not wait for headcount.

Question 64

What is CISO as a Service, and when does it beat hiring an internal CISO?

Accepted Answer

A senior security executive leads your strategy, risk management, corporate policies and reporting to the board. It makes more sense when you need senior decision-making but do not have the workload for a full-time dedicated professional, or when the market price exceeds what the role can support today. It also works well as a bridge: the CISO as a Service builds the program while you prepare the internal hire.

The questions you would ask in a first conversation

About DM11

AI and governance

Governance, risk and compliance

Cybersecurity

Security Office as a Service

Business continuity

DM11 products

Engagement and proposals

Still have a question that is not here?

The questions you would ask in a first conversation

About DM11

AI and governance

Governance, risk and compliance

Cybersecurity

Security Office as a Service

Business continuity

DM11 products

Engagement and proposals

Still have a question that is not here?

The questions you would ask in a first conversation

About DM11

What does DM11 do?

How long has DM11 been in the market?

What sets DM11 apart from other consultancies?

Does DM11 resell security tools?

What certifications does the DM11 team hold?

How does the day-to-day engagement work?

Does DM11 work with companies of any size?

Do you serve companies outside São Paulo?

How does a project with DM11 start?

Who runs the projects: your own team or subcontractors?

How does DM11 handle confidentiality?

What languages does DM11 work in?

AI and governance

What is AI Trust?

Why govern the use of AI in my company?

What is ISO/IEC 42001?

Does the EU AI Act apply to my Brazilian company?

Where does AI regulation stand in Brazil?

What is an AI Risk Assessment?

What is shadow AI and why should I worry about it?

What is prompt injection?

What other security risks do LLM applications bring?

What is data poisoning?

What is AI Red Teaming?

How do you audit bias and explainability in a model?

Do I need a responsible AI use policy?

When is the right time to start governing AI?

Governance, risk and compliance

What is IT GRC?

What is ISO 27001 and what does DM11 do on that project?

How long does ISO 27001 certification take?

What is ISO 27701?

How does a PCI DSS project work and what is the QSA's role?

What is the difference between SOC 2 Type I and Type II?

What is ISAE 3402?

What do BACEN resolutions CMN 4,893 and BCB 85 require?

What does an LGPD compliance project look like?

Do I need a DPO? Can I outsource it?

How should we respond to data subject requests?

Why assess the security of my suppliers?

A client sent me a huge security questionnaire. How do I answer it?

How do I prepare for an audit?

Is being compliant the same as being secure?

Can one program cover several standards at once?

What is the difference between certification and compliance?

What is a security roadmap for?

Cybersecurity

What is a penetration test and what is it for?

What is the difference between a pentest and a vulnerability scan?

What are black box, grey box and white box pentests?

How often should my company run a pentest?

How does a web application pentest work?

Do you test APIs?

Are mobile apps in scope?

Do you test external networks, internal networks and wireless?

How does cloud security assessment work?

What is a retest and is it included?

What is in the pentest report?

What are SAST and DAST, and how do they differ?

How does phishing simulation work, and does it expose employees?

What is vulnerability management?

Do you handle incident response and digital forensics?

What is Cyber Threat Intelligence and what is it good for in practice?

Can a pentest disrupt or take down my operation?

We found flaws in the test. What do we do now?

Security Office as a Service

What does contracting security as a Service mean?

What is CISO as a Service, and when does it beat hiring an internal CISO?

Do you offer DPO as a Service?

What is Ethical Hacker as a Service?

How does DevSecOps as a Service work?

And Business Continuity as a Service, what does it deliver?

How many hours per month are included?

If I later want to bring the team in-house, how does the transition work?

Does it work for a company that already has a security team?

Who answers to the regulator: DM11 or my company?

How is the result measured?

How do you handle confidentiality and access to our systems?