Nexa

BACKGROUND

Please describe your company and position.

 I am the Technology Partnerships & Solutions Lead of an information technology company 

Describe what your company does in a single sentence.

At our company, we collaborate to improve every interaction with your customers, driving innovation through our Contact Center & BPO services and Technological Developments to achieve a unique experience.

Our value proposition is based on a synergistic, innovative, and complementary model. We empower digital transformation and promote the omnichannel experience for businesses.

For over 25 years, our employees and our customers have been at the heart of our work, ensuring that working together is a positive and memorable adventure.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Nexa to accomplish?

• The objective of this project is to understand the current state of the Technological Platform and the Cybersecurity posture of the infrastructure

SOLUTION

How did you find Nexa?

Referral

Why did you select Nexa over others?

Referred to me

Describe the scope of work in detail. Please include a summary of key deliverables.

Based on the consulting work carried out, the following conclusion was reached:

The following consolidated action plan was determined

to address the improvement opportunities and recommendations in a structured manner. The plan is divided into execution phases, from the most urgent and critical actions to medium-term strategic improvements.

Phase 1: Critical Risk Mitigation Actions

This group contains the findings with the highest risk to security and business continuity. They must be addressed with the highest priority.

● Critical Access Security

○ Implement MFA on VPN access: deploy a multi-factor authentication solution for all remote access to the corporate network.

○ Secure AWS root accounts: activate MFA and remove any existing access keys in the root account of all AWS accounts. ● Public Exposure Remediation

○ Audit and remediate security groups in AWS: conduct a thorough review to restrict unrestricted access (0.0.0.0/0) to management ports (SSH, RDP) and databases in all security groups.

○ Block public access to S3: audit all S3 buckets, remediate unintentional public access, and enable "S3 Public Access Blocking" at the account level as a preventative measure (in case there are no public buckets).

● Sensitive Data Protection

○ Encrypt data at rest in backups: implement encryption for all backup data from on-premises solutions (IDPA and Acronis). ● Basic Visibility and Auditing:

○ Enable AWS CloudTrail at the organization level: Activate CloudTrail in all regions and for all accounts, ensuring that logs are securely stored. This is a non-negotiable step for cloud security.

Phase 2: Fundamental Governance and Security Enhancements

Once immediate risks are mitigated, this phase focuses on establishing the foundation for secure and efficient long-term management.

● Cloud Governance:

○ Establish a Cloud Governance Committee: Formalize a cross-functional team to define and enforce cloud usage, security, and cost policies.

wearenexa.com

4

Infrastructure Assessment

○ Implement a landing zone: Use AWS Control Tower to standardize the deployment of new accounts with security and governance baselines. ○ Implement a security governance account and activate native AWS security tools:

■ AWS Cloudtrail, to obtain AWS usage audit logs.

■ AWS GuardDuty, for threat detection.

■ AWS Security Hub, to obtain a centralized view of the security posture.

● Identity and log management:

○ Federate identity management in the cloud: plan and initiate the project to integrate AWS authentication with Azure AD.

○ Expand log ingestion in the SIEM: integrate logs from critical assets (firewalls, switches) and cloud environments with the SOC's QRadar solution.

○ Centralize operational logs: begin evaluating and implementing a centralized platform (e.g., ELK Stack) for collecting troubleshooting logs from the entire hybrid environment. 

● Technical Debt Remediation:

○ Plan the migration of obsolete systems: create a roadmap

to decommission or migrate servers running Windows Server 2003.

Phase 3: Optimization and Operational Maturity

This phase focuses on improving the efficiency, resilience, and standardization of IT operations.

● Automation and Processes:

○ Adopt Infrastructure as Code (IaC): initiate a pilot project

to manage a service on AWS using Terraform or

standardizing the use of CloudFormation, with versioned code in

a repository.

○ Formalize hardening policies: document and apply secure configuration baselines

for all new operating systems and

applications.

○ Establish a formal on-call process: define and communicate an on-call schedule for after-hours incident response. 

● Resilience and Monitoring:

○ Implement On-Premise Storage Replication: Evaluate and implement a solution for replicating storage data between the two data centers.

○ Unify and Improve Monitoring: Evolve towards a unified monitoring tool for the hybrid environment that includes observability and APM capabilities.

● Continuous Security Management:

○ Ensure Password Manager Adoption: Drive full adoption of Bitwarden across all technical teams.

wearenexa.com

5

Infrastructure Assessment

○ Expand Pentest Coverage: Ensure that future penetration tests comprehensively cover the services and applications deployed in the cloud.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

The deadlines for deliverables were always respected, responding to the needs and the established plan, and explaining the points worked on through a meeting.

What was your primary form of communication with Nexa?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

Their attention to detail and follow-up of the proposed actions were impressive.

Are there any areas for improvement or something Nexa could have done differently?

N/A

BACKGROUND

Introduce your business and what you do there.

I’m the CISO for Red Pagos & Midinero, two companies in Uruguay. We're in the financial industry.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Nexa?

We needed cybersecurity services.

SOLUTION

What was the scope of their involvement?

Nexa provides us with various cybersecurity services, including red team services, penetration testing, and ethical hacking exercises. The team also works on brand protection for both our companies and serves as first responders in case of cybersecurity incidents. In fact, Nexa provides services 100% remotely.

Initially, we contracted their services for penetration testing and ethical hacking. We had to review some critical applications to detect vulnerabilities. We had an exercise between three providers and chose Nexa. During the exercise, Nexa detected some interesting vulnerabilities in our system, which we had to correct as soon as possible.

So now, if we have a cybersecurity incident, we can call them for assistance. Currently, we also have brand protection and incident response services. We have a certain number of hours dedicated to penetration testing and ethical hacking exercises. It also depends on if we have a specific project to deliver to production.

What is the team composition?

It depends on the project. Nexa assigns the best resources to different projects.

For example, if we have a project related to AWS, they assign internal resources that are more specialized in those systems. We’ve had contact with five different people from the company. It depends on the service, but there is generally a team of 4–5 people assigned to penetration testing and ethical hacking projects.

How did you come to work with Nexa?

Nexa is a well-known company in Uruguay for many cybersecurity services. My first approach was through a referral, but I’ve known them for five years. Their experience convinced us to engage them.

How much have you invested with them?

We pay a monthly fee for brand protection. The total investment range is between $10,000–$49,000.

What is the status of this engagement?

We've been working with Nexa since July 2024, and the engagement is ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

In general, during all the penetration testing exercises, Nexa has discovered interesting vulnerabilities in our system. They never fail to find vulnerabilities, which is valuable for us. They also provide us with a very agile response time if we need them to assist us with a cybersecurity incident.

What I like the most about Nexa is that they don’t only scan applications. They think like hackers and have the mindset of what fraudsters can exploit from vulnerabilities. The reports from their ethical hacking and pen testing exercises are very well explained. There is a lot of technical vocabulary, but they have a great ability to translate those technical vulnerabilities into risks. Overall, their work quality has exceeded our expectations.

How did Nexa perform from a project management standpoint?

Nexa’s project management is very good. We have an assigned figure, and their responsibility is to follow up on the different kinds of services they give us. They are very aware and careful about the quality of the service they give us. We have very good communication with the company. Generally, we use Google Meet, emails, and phone calls.

What did you find most impressive about them?

Nexa does a great job in penetration testing and brand protection. They translate technical vulnerabilities into risks that our company's C-suite can understand, which is valuable to us. We are very satisfied with their work.

Are there any areas they could improve?

No, there aren’t any. They’re giving us very good service. I don’t have any pain points or recommendations. We’re very satisfied with their services.

Do you have any advice for potential customers?

It’s essential to compare Nexa's services with other solutions. Compared to the Uruguayan market, they’re the best in class, so I totally recommend them.

BACKGROUND

Introduce your business and what you do there.

I'm the CEO of GNS Software. We're based in Uruguay and provide cloud-based SaaS products to about 3,000 clients.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Nexa?

I brought Nexa to help me get things in order because, when I met them, I was having issues with one of my products' performance. Although we had coding skills, we lacked software infrastructure knowledge. Therefore, when my company started growing, we had to provide professional maintenance to our products in ways we didn't know.

One of these issues was that we were working with a local physical server provider, and that server went offline every now and then. Whenever that happened, the service provided rebooted the physical server so it would work again. Still, this was a big issue. At one point, we ran one of our products through an ethical hacking process and found a lot of vulnerabilities.

Once we discovered that we had cybersecurity issues, we decided to implement a web app firewall. However, our system started to get chaotic and have strange behavior. Therefore, I decided to hire Nexa to help us out.

SOLUTION

What was the scope of their involvement?

Nexa provides us with managed IT and cybersecurity services. Initially, I hired them to help us fix our product's vulnerabilities, going from the most critical to the least. Their team first delivered a proposal for a project to implement multiple high-availability servers to better support our product.

From there, we worked with Nexa to create a solution implementation schedule for the issues that we needed to solve, going from urgent matters to mid-term and long-term solutions. The team started making adjustments to our servers' infrastructure, including revamping MySQL's servers and reconfiguring Apache. They implemented a lot of configuration changes.

Once Nexa solved the urgent performance issues, we started diving into an analysis process. They worked with us to understand what we did and started getting familiarized with our company and products so that they could provide advice and guidance through a secure roadmap.

Since then, Nexa has created a cybersecurity roadmap for us, which we update every two years. Thankfully, our company has kept growing, so we constantly have IT infrastructure and cybersecurity needs, which they've continued to address.

What is the team composition?

Initially, we worked with Juan (COO), Mauricio (Database Administrator), and another teammate with expertise in IT infrastructure. Juan was in charge of overseeing the initial project, and the other two teammates worked on it, each focusing on their expertise.

After the initial project, there was a team turnover. Juan keeps working with us, but we now also work with Claudio (Technical Account Manager), who is in charge of our roadmap strategy and planning. He's currently our main point of contact from Nexa. We tell Claudio about everything we require, and he's in charge of passing the information down to his team.

We also work directly with technicians and engineers from Nexa, who enter the project depending on the urgency of the task they need to handle. For example, if our server fails on a Sunday, even Juan helps us directly. If an issue occurs within the week, he delegates the task to one of these technicians.

How did you come to work with Nexa?

We found them through a referral. One of our clients is a financial services company. An IT and cybersecurity consulting company worked with our client on a cybersecurity development project. During this project, the IT company found vulnerabilities within our system, so this company recommended Nexa.

How much have you invested with them?

We've spent around $25,000 per year. Still, this year the fee almost doubled, so we're now spending around $40,000–$50,000 per year.

What is the status of this engagement?

We've been working together since 2017.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

Immediately after Nexa started making changes to our server's configuration, we noticed an improvement in our system's performance. Since that moment forward, we've basically delegated our peace of mind to Nexa. We can go to sleep with the confidence that, if something happens, they'll be there to help us out.

Overall, we're very happy with Nexa's work. Now, the continuity of my business is in Nexa's hands, which speaks volumes about the confidence we have in them and the quality of their work. If I weren't happy with their work, I would be already bee looking for a different service provider.

How did the company perform from a project management standpoint?

One of the greatest things we've done with Nexa is that we've established a WhatsApp group chat on which engineers from both companies are. Thanks to this group chat, whenever we have a request, their response is almost immediate. Therefore, we trust that they always take care of us. In addition to WhatsApp, we also use email, Google Meet, and Zoom to communicate.

Urgent matters are discussed via WhatsApp. Non-urgent matters and requests are communicated via email. Additionally, we have video calls to analyze more in-depth issues.

Around 99% of our collaboration has been online. Nexa's entire work is done remotely. Still, whenever we need to discuss mid-term strategies or business needs, we meet in person. We've decided to meet in person for these discussions in order to establish a trusting relationship, given that we've given them access to our servers and credentials.

Every month, Nexa provides us with a performance report detailing different statistics, such as how long our server was online that month. Thus far, everything has been aligned. Sometimes, our projects take longer than expected, but most times, delays aren't Nexa's fault. Most delays are our fault because we don't spend as much time on these projects as we should.

Still, it's important to recognize that there's always room for improvement for us — it's an endless path. We always have new things to look at, update, or improve.

As for the budgeting, the cost fairness depends on how the client sees it. Back when we had the most issues to be fixed, Nexa's fees were cheaper. Now that we've fixed a lot of issues, their fee is higher. To me, their cost is a bit expensive. However, this is their business, and things have changed since we first engaged.

Today, we don't pay them for what they do; we pay them for the compromise and confidence that they're there for us to solve any issue. I'm paying to have cybersecurity and tranquility for my business.

Are there any employees from the service provider's team that you would like to give a shout-out to in this review?

Although the whole Nexa team has been very good, I would like to congratulate Juan. He has been with us through our most difficult times. For example, we had an issue early in January. I don't remember if it was January 1st, but I do remember that they were on vacation. However, something important happened with the development of a solution, and Juan showed up to help us. Whenever his teammates can't find a solution, we go back to Juan, and he always finds the solution. He's like God to us.

What did you find most impressive about them?

Nexa solves problems and then negotiates. Their team first focuses on putting fires down. Then, they work with us to reach a payment arrangement. This approach is very valuable because they share our company values. We also first help our customers, and we then reach an agreement with them. With this approach, they don't hold the client hostage to get paid.

Are there any areas they could improve?

I don't have any suggestions for improvement for Nexa; I'm very happy with them. Sometimes, our roadmap timeline extends because other things arise. As a company CEO, I would like to have everything solved at once, which isn't possible. In reality, Nexa is very responsive and energetic. They're always following up on us, which allows us to keep the project moving. They always push to make things happen.

Do you have any advice for future clients of theirs?

I have no particular advice.

BACKGROUND

Introduce your business and what you do there.

I'm the head of the non-financial risk department at a public bank.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Nexa?

We required penetration testing (pentesting) and ethical hacking services. Our goal was to have continuous support and feedback; we didn't want to work with a service provider who only delivered reports. 

SOLUTION

What was the scope of their involvement?

Initially, we had a meeting with Nexa's team about how the bank intended to develop the service we hired. Afterward, we had follow-up meetings with the team to present the team's results of the different project stages. We selected what Nexa would work on, and the team returned with a report of their findings and accompanied it with a meeting to help us understand those results. 

Nexa followed the same process at each project stage, which was carried out in an environment we previously selected. We gave Nex's team the necessary attributions so they could work on our systems. The team was given a deadline to run the necessary tests and then gave us the report with the explanatory talk to present the vulnerabilities found and proposed solutions. 

After implementing the solutions presented in their reports, Nexa carried out tests to see if they had solved the detected vulnerabilities. The project focused on finding vulnerabilities and improvements, and we made decisions based on those recommendations.

What is the team composition?

We worked with around 5–6 teammates from Nexa, although the team isn't always the same since each project stage required different specialists. My direct point of contact was Claudio (Technical Account Manager), who managed the relationship between Nexa and us as a client.

How did you come to work with Nexa?

We're a public organization and must make an open call to hire service providers. Nexa made an offer based on the conditions and demands we requested. We selected Nexa because of their offered quality and price relation over the other bidders. Additionally, we had previously worked with Nexa, and that was a plus because they already knew our company.

What is the status of this engagement?

We started working with Nexa in May 2023, and we're currently closing the project. We're also engaged with Nexa on a different cybersecurity project that is still ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

Nexa detected 11 vulnerabilities in the environment we selected, providing strategies and recommendations to solve the detected vulnerabilities effectively.

How did Nexa perform from a project management standpoint?

Nexa delivered work on time and communicated well with us. We communicated via email and virtual meetings on Microsoft Teams.

What did you find most impressive about them?

Nexa's greatest strength was their permanent exchange with us and their willingness to work and adapt to our project. Nexa proposed coherent solutions based on their knowledge of our institution.

Are there any areas they could improve?

I can't think of anything for Nexa to improve. I don't have extra demands because they did a fantastic job.

Do you have any advice for future clients of theirs?

I suggest clients ensure they have the required availability to address Nexa's needs and recommendations. If working with Nexa creates more complexities in your work or the project is larger than you can handle, the project will most likely not be successful. What generates quality in Nexa's service is that they accompany their clients, but clients must also be available to receive their service and recommendations. 

I also recommend being open to the solutions proposed by Nexa and not taking them as criticism since the team's goal is to help their clients improve.

BACKGROUND

Introduce your business and what you do there.

I’m an IT expert for a transportation company. I’m in charge of the entire company's IT area. We have 75 people, and I handle everything at the IT and communications levels.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Nexa?

We needed a cybersecurity services provider.

SOLUTION

What was the scope of their involvement?

We’ve involved Nexa in governance issues, such as establishing an entire cybersecurity framework. They’ve also helped us with the whole risk management part of writing policies and processes from the mother computer security policy toward the policies dependent on it that go down to the IT unit level, first through the organizational side and then to the units from the IT unit.

Initially, Nexa delivered a work plan. After establishing the scope and seeing the company’s background, they offered an estimate of hours to execute and deliverables. 

They offer remote and in-person services. They’ve given an on-site awareness talk on cybersecurity issues for the entire company; they came in and gave the training. We also work remotely, connecting every week.

What is the team composition?

We had two teammates during the scope definition. On a daily basis, we have two other people. One is a teacher at the ORT Uruguay University in cybersecurity and ethical hacking who helps us prevent attacks because he knows how to attack. The other is focused on the defensive part of preventing cyber attacks, so they’re a good combination.

How did you come to work with Nexa?

Our purchasing process required us to choose three suppliers. In Uruguay, since everything is small, we often know the people who work at the companies. I knew someone who worked at Nexa in cybersecurity, so I included them in the selection process. 

I asked for the companies’ proposals, and they presented them. Management opened them and determined the selected company. After a comparative analysis of prices, deliverables, quality, and curriculum, the purchasing department stayed with Nexa. Their technical score and pricing favored them.

How much have you invested with them?

So far, we’ve spent less than $10,000. We plan to get to the top of the package, which is about $15,000.

What is the status of this engagement?

We began working with them in October 2023. Since we have an hourly package, we’ll continue working with them until we consume all the hours. We’ll probably do another ethical hacking and vulnerability testing project with them this year.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

It’s always difficult to measure these topics. In particular, we’ve seen the password complexity level increase, so we’ve successfully forced greater controls. Nexa has made users more attentive when they’re generating passwords, which was one of the weakest cybersecurity points we detected.

Thanks to Nexa’s talk in our organization, users understood that they couldn’t set trivial passwords to access the system. We’ve also improved the company’s openness to cybersecurity, especially by making them more aware of threats and how attacks work.

Other than that, we don’t have an exact IT metric. Regarding quality, Nexa follows our documentation standards using international frameworks, such as ISO 27001 and a cybersecurity framework in Uruguay based on NIST. Nexa works under these metrics, looking for the documentation, processes, and controls we need to be certified in the future.

How did Nexa perform from a project management standpoint?

Nexa meets the deliverables satisfactorily and fully complies with our time for the sessions. When we ask them to move them, they show flexibility. Moreover, the price is exactly what we’ve stipulated. I’ve asked them to give me details of how they spend the hours, which wasn’t included initially. They’ve already given me the breakdown of the first month.

We hold meetings with them every week to coordinate the tasks between us and the deliverables for next week. We mainly communicate through emails, Google Meet, and phone calls if necessary. We’re not using a ticket management system.

Are there any employees from the service provider's team that you would like to give a shout-out to in this review?

Bruno (Technical Account Manager) has established all the processes and written the documentation. Javier (Ethical Hacker) gives us insights into the attack and cybersecurity threats; he explains how an attack is perpetrated so we can understand how to defend ourselves. 

They’re both really valuable and have helped us in everything. Overall, they provide knowledge in both aspects, which serves us for what we want to achieve for our company.

What did you find most impressive about them?

What has impressed me the most is their ability to implement policies correctly. Security policies are always at an organizational level, but the rest of the policies and processes don’t have to be for the whole company. Nexa has suggested keeping them in the orbit of the IT department so they’re controlled by the area. 

In summary, Nexa focused on dividing what had to be approved and implemented company-wide and what parts were the responsibility of the IT department. At first, I thought everything was for everyone, but it wasn’t like that.

Additionally, they brought a pre-made risk management plan. Without knowing our company, Nexa started with the common risks and proposed a template we still use daily to track how we advance controls together.

Are there any areas they could improve?

No, they’ve complied well with the pace we’ve asked them to work. When we ask them to be on top of the project to help us push it, they’re there for us. We don’t identify an improvement area from our perspective; Nexa has worked well with us.

As a small company, it’s just me and one more colleague in the IT area, so sometimes it’s difficult to advance some points. However, Nexa understands that and fulfills what we need.

Do you have any advice for potential customers?

We get the most out of them by clarifying where we want to go.  When you clearly define the scope, it immediately gives them a framework of where to aim, and they take you through that.

Therefore, I recommend putting together the existing documentation, establishing the governance, and having a quick conversation with them about the deliverables you expect. In our case, we searched for the needed deliverables, put them in an RFP, and put together the documentation to present it on day one.

BACKGROUND

Introduce your business and what you do there.

I'm the IT manager at BROU (Banco de la República Oriental del Uruguay).

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Nexa?

We originally needed to enhance our technical capabilities to develop an IT automation program.

SOLUTION

What was the scope of their involvement?

Nexa provides us with IT consulting and cybersecurity services. When we first hired them, we defined a project scope: develop an automation tool that allowed us to work with a code-based infrastructure. Nexa also defined the technology to use and created and implemented automation integrations. The technology stack included Red Hat, Ansible, and Terraform.

Since then, Nexa has worked with us on different initiatives within our organization. We generally seek tech support from their team to carry these initiatives to completion.

What is the team composition?

We've worked with around eight teammates from Nexa, including a project manager, a tech specialist, and various other technicians specialized in the different products we use.

How did you come to work with Nexa?

We found them through a personal recommendation.

How much have you invested with them?

We've spent over $500,000.

What is the status of this engagement?

Our first project started around July 2016, and our engagement is ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

Thus far, Nexa has successfully helped us advance in all our initiatives. Their team has continuously demonstrated a lot of knowledge about the technologies for which we seek their help.

How did Nexa perform from a project management standpoint?

Nexa usually delivers on time, and our communication is very streamlined. We've established a monthly meeting cadence, and we follow up on all the points of our checklist during those meetings. Although we've had delays on some projects, that issue is common for these types of projects. We communicate via Google Meet and phone calls. Additionally, Nexa provides us with a monthly report detailing every task completed during the month and the status of pending tasks.

What did you find most impressive about them?

I would like to congratulate the whole Nexa team. They've had a great performance thus far, so we're still engaged and active. They always have a proactive mentality, constantly seeking new things to do within our organization. Overall, they're a very interesting service provider for us.

Are there any areas they could improve?

For certain development projects, Nexa has occasionally delivered after the deadlines, so they could improve in that regard.

Do you have any advice for future clients of theirs?

Establish frequent follow-ups with your service provider.

BACKGROUND

Introduce your business and what you do there.

I'm the general manager of a financial services company.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Nexa?

We needed a diagnosis and audit of our company's cybersecurity. 

SOLUTION

What was the scope of their involvement?
We had a couple of meetings with Nexa to discuss our company's needs. The team explained their way of working, and the audit was carried out over a period of 20 days. Nexa gave us a document with a diagnosis of the strengths and weaknesses of our cybersecurity, as well as a strategy to improve it. The solution to these vulnerabilities was in charge of a different service provider.

What is the team composition?

We worked with three teammates from Nexa.

How did you come to work with Nexa?

Our company has two sister companies in Uruguay, and one of them previously worked with Nexa and referred them to us.
How much have you invested with them?

We spent around $11,000 on this project.

What is the status of this engagement?

We worked with Nexa in May 2023.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

Nexa's work met our expectations, and the team identified vulnerabilities of different levels in our company's cybersecurity.

How did Nexa perform from a project management standpoint?

Nexa delivered work on time and stayed on budget. The team had excellent communication via virtual meetings.

What did you find most impressive about them?

Nexa's biggest strengths are their human touch and communication. I was also impressed by the team's technical expertise.

Are there any areas they could improve?

I can't think of anything for Nexa to improve.

Do you have any advice for future clients of theirs?

I recommend future customers have open communication and enough disposition to provide Nexa's team with the information they require.

BACKGROUND

Introduce your business and what you do there.

I’m the IT manager of an insurance company in Uruguay.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Nexa?

We needed someone to help us assess our infrastructure.

SOLUTION

What was the scope of their involvement?

Every time we have an infrastructure change, Nexa provides support. Initially, we had a meeting before they made a formal job offer. We reviewed our servers' infrastructure, equipment, and different software versions. Nexa explained their expertise areas and where they could be more effective.

We have a monthly contract with Nexa. In the last year, we’ve been in contact more frequently. They monitor all the neighboring structures and install tools that alert us of possible network problems.

Moreover, they solve problems when they happen. They’ve helped us carry out specific infrastructure, server migration, OS updates, and security installation projects. Our goal is to get second-level support when our internal team can’t solve a situation.

What is the team composition?

Juan (COO) is our project manager. We also have a commercial associate, a technical associate, and 3–4 technicians with knowledge in different areas.

How did you come to work with Nexa?

A colleague knew Nexa’s owner. He worked independently for IBM over 10 years ago and kept in touch with him.

How much have you invested with them?

Last year we spent $20,000. 

What is the status of this engagement?

We began working with them in November 2022, and our relationship is ongoing. We plan on having more projects with them.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

We aim to have uninterrupted services. Nexa’s work has improved us, and when we have a fall, they solve it quickly. Overall, Nexa has exceeded expectations.

How did Nexa perform from a project management standpoint?

In each project, we first have a scope definition stage where Nexa proposes the number of hours to complete the work. They plan the schedule because server updates imply that our service is down, so it has to be after hours. During the execution phase, they keep us informed and give us access so we can control their working hours.

We generally use Google Meet for planning meetings and a ticketing system for all reports and requirements. We can also communicate directly with the project manager, their boss, or the owner’s cellphone. Additionally, Nexa shares a report of the hours they’ve dedicated to each project.

What did you find most impressive about them?

Nexa is very transparent; we’ve built a trustworthy relationship. If they can’t do something, they say it right away and don’t try to sell us anything else. 

Moreover, their technical proficiency is great. They’ve demonstrated that they have specialized knowledge in every area they’ve worked on. This year, they helped us change a sever until 3:00 a.m. Although it wasn’t planned, they answered quickly and went a step further to keep our services working.

Are there any areas they could improve?

No, I can’t think of anything to improve.

Do you have any advice for potential customers?

Be clear about your objectives and why you’re hiring them. Also, have as much documentation as possible on the company’s infrastructure.

BACKGROUND

Please describe your company and position.

I am the VP of Technology of Flokzu

Describe what your company does in a single sentence.

At Flokzu we build a process automation tool that streamlines and simplifies the work of thousands of companies, making them more efficient, and our users happier because they can use their time in tasks that matter.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Nexa to accomplish?

• Execute a penetration test on our platform and find weak points
• Put under stress the security on a specific system's integration we delivered recently

SOLUTION

How did you find Nexa?

Referral

Why did you select Nexa over others?

• Referred to me
• We previously worked in another company and I know their job

How many teammates from Nexa were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

The objective of the work was to perform the annual penetration test on our platform, seeking to define the impact of a security breach in the following aspects: confidentiality and integrity of data, availability of systems and internal infrastructure. In addition we launched an integration with legacy technology and it was vital to specifically analyze this integration from a security point of view. 

The key deliverables where: an executive summary report that can be shared with clients (which includes information about how the test was conducted, known standards and best practices applied, etc.) and a detailed technical report that also includes potential impact and recommendations.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

They found weaknesses that where of high value for us, and other couldn't find in the past.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Yes they responded in time whenever we needed them, and deliver what we expected in terms of the project.

What was your primary form of communication with Nexa?

Email or Messaging App

What did you find most impressive or unique about this company?

What impresses me most every time I work with them is the technical aspect of the team, they know what they do.

Are there any areas for improvement or something Nexa could have done differently?

We had a small misunderstanding when starting the project, it was a communication problem. After solving that everything worked smoothly.