We attack you before someone else does

Offence, defence and compliance from one team: Red Team and penetration testing, cyber defence with incident response and digital forensics (DFIR), and readiness for ENS, NIS2, DORA and ISO 27001. Certified OSCP, CRTO II, CISSP and CISM, ranked Top 1% on Atenea, the platform of Spain’s National Cryptologic Centre (CCN-CERT).

Book 30 minutes with a specialist

Red TeamCyber defenceDFIRCompliance (GRC)

Digital forensics and expert witness services

Need to prove what happened?

An incident, a dismissal, a data leak or open litigation in Spain. We acquire the evidence without altering it, analyse it with a reproducible method and sign an expert report that survives cross-examination. We report in English for your legal and executive teams, and appear before the Spanish court. Party-appointed or court-appointed.

Documented chain of custodyISO 27037 · UNE 71506Ratified in Spanish courtsReporting in English

See the forensics service →Call now: +34 686 250 244

If the incident is live, do not power anything off or rebuild it. Isolate the affected machines from the network and call us before touching the systems: every hour that passes destroys volatile evidence.

Six questions, twenty-two services

Pick the one that looks like your situation. We will tell you what you need, and also what you do not.

3 servicesI need to comply with a regulationNIS2, DORA, GDPR, AI Act, ISO 27001 and PCI-DSS. We tell you what applies to you, what is missing and by when it has to be closed.View services →9 servicesI want to know if they can get inWe attack you the way a real adversary would, with an agreed scope. Pentest, Red Team, applications, WiFi, RFID, phishing and offensive AI.View services →3 servicesI need to detect and respondNIS2 gives you 24 hours to notify. We build the detection capability and the response plan.View services →2 servicesIt already happened to meIncident in progress or open litigation. What happened, how they got in and what they took, with court-admissible evidence.View services →2 servicesI want to build on secure groundAWS, Azure and industrial environments. We design and harden from the start instead of patching afterwards.View services →3 servicesI want to use AI without exposing my dataLanguage models and RAG on your own infrastructure. Your documentation never leaves your network, and never trains anyone else.View services →

Looking for training for your team? See our cybersecurity courses.

Ongoing consulting, without growing your headcount

KICK-OFF · 50 hours

To close one specific objective: an audit with its remediation plan, preparing a certification or reinforcing a project already under way. Assigned consultant, executive and technical report. From 109 Eur/h, no expiry date.

CONTINUITY · 100 hours

To support you all year round: periodic reviews, handling of minor incidents and backup for your internal team whenever something comes up. You decide how each hour is spent. From 104 Eur/h, no expiry date.

EXTENDED TEAM · 250 hours

For organisations with no security department of their own. Annual plan, execution and board-level reporting, delivered by the same certified team that signs the audits. From 90 Eur/h, no expiry date.

Who runs your auditWe do not subcontract. The team that audits is the team that signs the report.These are the certifications behind every report we deliver.

Offensive security and Red TeamOSCPCRTOCRTO IIeWPTXeCPPT API Penetration TestingHack The Box Pro LabsMaldev Academy

Digital forensics and incident responseeCDFPIncident Forensic Analysis (INCIBE)Court-admissible expert reports

Governance, risk and complianceCISSPISO 27001 Lead AuditorCCSP (ISMS Forum)CDPP (ISMS Forum)Spanish ENS and Risk Analysis (CCN)PMP (PMI)

Industrial and OTCCI Black Level ProfessionalOT Industrial CybersecurityUniversity Postgraduate Course

IntelligenceCyber Intelligence and OSINT (CCN)

Top 1 %on the CCN-CERT Atenea platform

1st placeWeb Hacking · CCN-CERT STIC Conference 2025

WinnersNavaja Negra 2025

Part of our team holds Personnel Security Clearance, a requirement for handling classified information in public administration and defence projects.