Enterprise security, operated across the region.
Leiva Consultores runs security for mid-market and enterprise organizations with operations across Latin America — a 24/7 detection and response operation with AI-assisted triage, incident response with contractual commitments, and compliance programmes that hold up in every country you operate in.
and response
Mexico City
in the loop
markets in the region
Advise. Operate. Respond.
Most providers sell you one of these and leave the other two to you. At mid-market and enterprise scale that gap is where incidents live — the strategy, the daily operation and the emergency path have to be the same team, accountable to the same outcome, across every site you run.
Consulting
Where you actually stand, what to fix first, and in what order — measured against the frameworks your buyers, auditors and regulators use, and consolidated across business units and countries rather than site by site.
- Security posture and gap assessment
- vCISO and board-level reporting
- Architecture and Zero Trust roadmap
- Compliance readiness and evidence
Managed services
We run it. A 24/7/365 detection and response operation built for distributed estates, with AI-assisted triage and a human analyst on every decision that matters — one SOC covering every country you operate in.
- MDR with L1–L3 escalation
- Vendor-agnostic, bring your own SIEM
- Continuous exposure management
- Consolidated reporting across sites and countries
Incident response
A retainer with a response time written into the contract — so the worst day of your year starts with a phone call that gets answered, not a procurement cycle.
- Contractual response SLA
- Containment, forensics and eradication
- Ransomware recovery with committed RTO
- Insurer and regulator reporting support
A SOC that escalates like one.
"24/7 monitoring" is the easiest claim in this industry to make and the hardest to verify. We have run a SOC at regional scale before — White Label, for channel partners across Latin America, with coverage handed around the clock between time zones. So here is exactly who watches your environment, what they are allowed to do without calling you, and the numbers you get to hold us to — the same operation whether you run one site or twenty across six countries.
Continuous telemetry and first triage
Round-the-clock ingestion across endpoint, network, identity, cloud and email. AI-assisted correlation suppresses the noise that buries real signal — with the analyst, not the model, owning the verdict.
Investigation and automated containment
Confirmed threats are investigated and contained through SOAR playbooks agreed with you in advance — isolate the host, disable the account, block the sender — so the clock stops while we are still on the phone.
Threat hunting and deep forensics
Proactive hunting against current adversary tradecraft, root-cause forensics after any material event, and the detection engineering that makes the same attack fail next time.
Organized by the problem, not the product category.
Nobody wakes up wanting to buy an NDR platform. They wake up because payments are being redirected, because a customer sent a security questionnaire, or because a plant stopped. Each service names the technology underneath it.
Identity & Active Directory
The route most breaches actually take. MFA extended to legacy systems and service accounts, privileged access controlled, and identity threat detection on the directory itself.
Email & payment fraud
Business email compromise is a finance problem wearing an IT costume. Behavioural AI on the mailbox, supplier-impersonation detection, and DMARC enforced properly.
Ransomware recovery
Prevention that assumes failure. Immutable backup, isolated recovery, anti-ransomware enforcement at the endpoint — and a recovery time objective we commit to contractually.
Continuous exposure management
An annual pentest is a photograph of a moving target. Continuous automated validation shows which exposures are genuinely exploitable in your environment this week — and which can wait.
Network detection & response
Attacker behaviour visible in the traffic itself — lateral movement, command and control, data staging — including the segments where agents cannot be installed.
Brand & domain protection
Lookalike domains, executive impersonation and fraudulent sites taken down before your customers are the ones who find them. Edge and DNS protection included.
Microsoft 365 hardening
Most tenants are deployed on defaults and never revisited. Configuration hardened to benchmark, conditional access enforced, and the audit trail switched on before you need it.
Mobile & endpoint
Phones and laptops are the perimeter now, especially for field and plant operations. Threat defense on mobile, EDR on the endpoint, one escalation path to the same SOC.
OT & industrial security
Manufacturing, petrochemical, logistics and ports. Passive visibility into the control network, IT/OT segmentation, and IEC 62443 alignment without touching production uptime.
AI governance
Your teams are already using AI. Governing what data reaches which model, controlling non-human identities and agent permissions, and documenting it to the standard auditors have started asking for.
vCISO
Senior security leadership at a fraction of a hire. Risk register, roadmap, budget defence, board and insurer reporting, and someone accountable who has done it before.
Supply chain & nearshoring compliance
A customer, a parent company or an insurer sent a security questionnaire and a deadline. We close the gaps, build the evidence and get you through the assessment across every entity in scope — then keep you through the next one.
One security operation. Every country you run in.
Multi-country operations usually end up with multi-country security: a different provider per market, different tooling, different reporting, and no single view of risk. We run one operation across the region — so an incident in Querétaro and an incident in Bogotá reach the same analysts, under the same playbooks, reported the same way.
Mexico, national
Delivery hubs in Ciudad de México and Monterrey, with coverage across the industrial corridors where our clients actually operate.
Latin America
Remote-delivered SOC and consulting across the region, with on-site work scheduled where the engagement requires it. Local regulatory requirements are handled per market, not averaged.
US and global headquarters
For groups headquartered outside the region, we operate in Spanish with the local teams and report in English to the parent — in the formats head office, auditors and insurers expect.
reported in English
across regional time zones
obligations handled locally
for every site
Leiva Consultores serves mid-market and enterprise organizations. Smaller operations are served by sister practices within the group, which carry their own partner rosters and delivery models.
Best-of-breed, selected per engagement.
We are deliberately vendor-agnostic. The platforms below are representative of what the group deploys and operates by category — the specific technology on any engagement is chosen for your estate, your existing investments and the country you are operating in. The technology is only half the value; the other half is a team that has deployed it in production across Latin America for two decades.
| Category | Representative platforms | What it stops |
|---|---|---|
| Identity & ITDR | Silverfort | Credential abuse, lateral movement, unprotected service accounts |
| Email security | Abnormal AI · Check Point Harmony | Business email compromise, invoice fraud, supplier impersonation |
| Endpoint & XDR | SentinelOne | Malware, loaders, hands-on-keyboard intrusion |
| Anti-ransomware | Halcyon | Encryption events, extortion staging |
| Network detection | Vectra AI | Command and control, data staging, agentless blind spots |
| Exposure validation | Pentera | Exploitable paths, not theoretical CVE counts |
| Edge, DNS & brand | Akamai | DDoS, lookalike domains, fraudulent sites |
| Mobile defense | Lookout | Phishing on mobile, compromised devices in the field |
| Backup & recovery | Cohesity | Unrecoverable data after an encryption event |
| SIEM & SOAR | Google Security Operations · BYO-SIEM | Fragmented telemetry and manual response |
Vendor-agnostic by design. If you already own a platform, we operate it rather than replace it — the SOC supports bring-your-own SIEM, EDR and firewall. Partner rosters vary across the group companies and by territory; the platforms available on your engagement are confirmed during scoping.
The audit your customer sends you, answered.
Compliance is rarely the reason a company calls us. It is almost always the reason they call us now — because a US customer, an insurer or a regulator set a deadline. We map the controls, close the gaps and produce the evidence.
Three ways to engage.
Each model has a defined scope and a clear path to the next as your operation matures. Scope is sized to your estate — number of sites, countries, users and regulatory obligations — and confirmed in writing before anything starts.
Essential
- Endpoint and email protection
- Business-hours monitoring and alerting
- Microsoft 365 hardening
- Quarterly posture report
- Onboarding assessment included
Managed
- Everything in Essential
- MDR 24/7/365 with L1–L3 escalation
- Automated containment via SOAR
- Identity and network detection
- Incident response retainer with SLA
- Consolidated reporting · MTTD / MTTR by site
Directed
- Everything in Managed
- vCISO with board reporting
- Continuous exposure validation
- Ransomware recovery with committed RTO
- Compliance programme and audit support
- Quarterly business review with the board
Find out where you stand before you talk to anyone.
No form wall, no sales call attached. Each one returns a result you can act on yourself — and if it shows something serious, you will know what to ask us.
External attack surface
What an attacker sees of you from the internet today.
Leaked credentials
Which of your corporate accounts are already circulating.
DMARC checker
Whether anyone can send email as your domain right now.
Downtime cost calculator
What one day stopped actually costs your operation.
Ransomware readiness
A 10-question self-assessment with a scored result.
Under attack right now?
If systems are encrypted, money has moved, or you have lost control of an account — stop reading and call. The line is answered 24/7. You do not need to be a client.
Do not shut anything down
Powering off destroys the volatile evidence needed to scope the incident. Disconnect from the network instead.
Do not pay anything yet
Not before scoping, not before checking recovery options, and not before the legal and insurance implications are understood.
Call us from a clean device
Assume email and chat are being read. Use a phone that is not on the affected network.
Twenty-five years on the other side of the table.
Leiva Consultores was built by operators who spent two decades taking security vendors into Latin America — selecting them, deploying them, scaling them to acquisition — and running the region’s leading distribution SOC while they did it. We know which technology survives contact with a real environment because we put it there, and we know what 3am in a SOC looks like because we staffed it.
In disclosed exits from the portfolio
Emerging security vendors developed and scaled internationally — several acquired by Cisco, AT&T, Ivanti, Rapid7 and Francisco Partners.
SOC in distribution across Latin America
Built and operated as a White Label service for channel partners region-wide — follow-the-sun coverage handing between time zones, so partners could sell managed detection without standing up an operation of their own.
In vendor portfolio under management
Security and infrastructure technology selected, deployed and supported across the region — the operating experience behind every recommendation we make.
What security leaders ask first.
We already have an IT team. Where do you fit?
Alongside them, not instead of them. Your IT team keeps the business running; we watch for the adversary and respond when one appears. In practice that means your team keeps ownership of the environment and we take ownership of detection, response and the escalation path at 3am.
Do we have to replace the security tools we already own?
No. The SOC is vendor-agnostic and supports bring-your-own SIEM, EDR and firewall. If you have already invested in a platform, we operate it. We only recommend replacing something when it genuinely cannot do the job, and we will tell you which gap we are trying to close.
What can you do without calling us first?
Exactly what you authorise, written down before we start. Most clients pre-approve isolating an endpoint, disabling an account and blocking a sender, because those three actions stop most incidents while they are still small. Anything with production impact comes to you first.
How fast do you respond to an incident?
Response time is written into the retainer rather than promised in a brochure. The target varies by package and environment, and we will tell you plainly what is realistic for your setup before you sign — including what we would need in place to make it faster.
Is the AI making decisions about our environment?
No. AI does the correlation and triage work that would otherwise bury an analyst in noise, and it is very good at that. A human analyst owns every verdict and every containment decision. We think anyone selling a fully autonomous SOC is either overselling or not telling you who is accountable when it is wrong.
Our US customer sent a security questionnaire with a deadline. Can you help?
Yes — this is one of the most common reasons companies call us. We map the questionnaire to the controls behind it, tell you honestly which gaps can be closed before the deadline and which cannot, build the evidence package, and support you through the assessment itself.
Do you work in English and Spanish?
Natively in both. That matters more in security than in most fields: the operation runs in Spanish with your local team, while the reporting your US headquarters, insurer or auditor receives arrives in English in the format they expect.
What happens in the executive assessment?
A focused working session. We establish what you are actually protecting, what your real exposure looks like, and what the fastest meaningful improvement would be. You leave with a candid read whether or not you work with us.
Book an executive assessment.
Thirty minutes. Bring your environment, your obligations and whatever is keeping you up. Leave with a clear read on your exposure and the fastest path to closing it. No pitch.