An independent security practice, built for the long engagement.
Eloquantico started in 2015 with a narrow conviction: most breaches are not the result of clever attacks, but of ordinary gaps left open too long. We close them, and we keep them closed.
We saw the same incident, again and again.
A misconfigured permission. A monitoring alert nobody triaged. A vendor with access long after the contract ended. The headlines talk about sophisticated threats, but the work that prevents most damage is patient and unglamorous.
So we built a practice around that work. No products to sell you, no platform to lock you into — just a team that treats your environment the way it would treat its own, and tells you the truth about where the risk really sits.
Principles, not slogans.
These shape every decision we make on an engagement. We would rather lose a contract than break one of them.
Plain language
A finding nobody understands is a finding nobody fixes. We write for the people who have to act on it, not for other security engineers.
Evidence over assertion
We do not ask you to take our word for it. Every claim about your posture is backed by something you can inspect.
Independence
We sell no software and take no vendor commissions. Our only incentive is recommending what is right for your environment.
Handover by design
A good engagement leaves your team more capable than it found them. We document so you are never dependent on us.
Discretion
What we learn about your systems stays between us. Confidentiality is written into every agreement and into how we operate.
Proportion
Not every risk deserves the same response. We help you spend where it counts and leave the rest documented.
Senior people, on your engagement.
Our consultants have run security at banks, fintechs, and health platforms. You work with them directly — not with a junior handed your account once the contract is signed.
Rafael Mendonça
Founder · Practice leadTwenty years across offensive testing and defensive architecture, including leading the security function at a Brazilian payments processor.
Camila Andrade
Head of detectionBuilds the monitoring pipelines behind our managed service. Former incident lead at a healthcare data platform.
Thiago Ferreira
Compliance & governanceTranslates LGPD and ISO 27001 obligations into controls clients can actually maintain. Background in regulatory audit.
Curious whether we're a fit?
The first conversation is about your situation, not our pitch. If we are not the right people for the job, we will tell you who is.