We attack you before someone else does

Offence, defence and compliance from one team: Red Team and penetration testing, cyber defence with incident response and digital forensics (DFIR), and readiness for ENS, NIS2, DORA and ISO 27001. Certified OSCP, CRTO II, CISSP and CISM, ranked Top 1% on Atenea, the platform of Spain’s National Cryptologic Centre (CCN-CERT).

Book 30 minutes with a specialist

Red TeamCyber defenceDFIRCompliance (GRC)

Digital forensics and expert witness services

Need to prove what happened?

An incident, a dismissal, a data leak or open litigation in Spain. We acquire the evidence without altering it, analyse it with a reproducible method and sign an expert report that survives cross-examination. We report in English for your legal and executive teams, and appear before the Spanish court. Party-appointed or court-appointed.

Documented chain of custodyISO 27037 · UNE 71506Ratified in Spanish courtsReporting in English

See the forensics service →Call now: +34 686 250 244

If the incident is live, do not power anything off or rebuild it. Isolate the affected machines from the network and call us before touching the systems: every hour that passes destroys volatile evidence.

Six questions, twenty-two services

Pick the one that looks like your situation. We will tell you what you need, and also what you do not.

3 servicesI need to comply with a regulationNIS2, DORA, GDPR, AI Act, ISO 27001 and PCI-DSS. We tell you what applies to you, what is missing and by when it has to be closed.View services →9 servicesI want to know if they can get inWe attack you the way a real adversary would, with an agreed scope. Pentest, Red Team, applications, WiFi, RFID, phishing and offensive AI.View services →3 servicesI need to detect and respondNIS2 gives you 24 hours to notify. We build the detection capability and the response plan.View services →2 servicesIt already happened to meIncident in progress or open litigation. What happened, how they got in and what they took, with court-admissible evidence.View services →2 servicesI want to build on secure groundAWS, Azure and industrial environments. We design and harden from the start instead of patching afterwards.View services →3 servicesI want to use AI without exposing my dataLanguage models and RAG on your own infrastructure. Your documentation never leaves your network, and never trains anyone else.View services →

Looking for training for your team? See our cybersecurity courses.

What is actually at stake

We don’t protect servers

We protect your continuity, your contracts, your customers and your reputation. An incident is never paid for in servers: it is paid for in the four things the business runs on, and rarely does only one of them go. That is what we work to prevent.

01 Continuity

A ransomware encryption stops operations for anywhere between three days and three weeks. What decides the length is not the antivirus: it is whether backups were isolated from the domain and whether anyone had ever tested restoring them.Disaster recovery →

02 Contracts

Without ENS conformity you cannot sign with the Spanish public sector. Without evidence of risk management, your financial client will not renew under DORA. Compliance stopped being paperwork: it is the entry requirement to the tender.Regulatory compliance →

03 Customers

GDPR gives you 72 hours to notify a breach, and your customers find out. What decides whether they stay is not that nothing happened: it is that you can state exactly what happened, who it affected and what you closed.Incident response →

04 Reputation

A breach tells its own story. Between «they got in and we do not know what they took» and an expert report with a closed timeline and scope lies the distance between a headline and a press note.Digital forensics →

Offence, defence and compliance from the same team. The people who attack you in the Red Team are the ones who answer the incident and sign the expert report. No subcontracting, no handovers between vendors.

Ongoing consulting, without growing your headcount

KICK-OFF · 50 hours

To close one specific objective: an audit with its remediation plan, preparing a certification or reinforcing a project already under way. Assigned consultant, executive and technical report. From 109 Eur/h, no expiry date.

CONTINUITY · 100 hours

To support you all year round: periodic reviews, handling of minor incidents and backup for your internal team whenever something comes up. You decide how each hour is spent. From 104 Eur/h, no expiry date.

EXTENDED TEAM · 250 hours

For organisations with no security department of their own. Annual plan, execution and board-level reporting, delivered by the same certified team that signs the audits. From 90 Eur/h, no expiry date.

Who runs your auditWe do not subcontract. The team that audits is the team that signs the report.These are the certifications behind every report we deliver.

Offensive security and Red TeamOSCPCRTOCRTO IIeWPTXeCPPT API Penetration TestingHack The Box Pro LabsMaldev Academy

Digital forensics and incident responseeCDFPIncident Forensic Analysis (INCIBE)Court-admissible expert reports

Governance, risk and complianceCISSPISO 27001 Lead AuditorCCSP (ISMS Forum)CDPP (ISMS Forum)Spanish ENS and Risk Analysis (CCN)PMP (PMI)

Industrial and OTCCI Black Level ProfessionalOT Industrial CybersecurityUniversity Postgraduate Course

IntelligenceCyber Intelligence and OSINT (CCN)

Top 1 %on the CCN-CERT Atenea platform

1st placeWeb Hacking · CCN-CERT STIC Conference 2025

WinnersNavaja Negra 2025

Part of our team holds Personnel Security Clearance, a requirement for handling classified information in public administration and defence projects.