WAYSTOSECURE
You do not need an in-house security team to be protected: you need someone who looks at your company the way an attacker would, every month, and tells you what to close first. That is what we do — with your written authorisation, within the agreed scope and with a person by your side.
Published services nobody remembers, a misconfigured email that lets anyone impersonate you, employee credentials in breaches, a forgotten subdomain running an old version. None of it shows up in any report until someone exploits it.
Most small businesses have no security team, and they do not need one. They need someone to look for them with an attacker's eyes, test it with permission, and explain it in plain language.
This is where we start.
A sixteen-block audit — external exposure, email and domain, web, network, identities, servers, backups, third parties, compliance… — that gives you a clear map of where you stand and an action plan ordered by risk. With your written authorisation before we touch anything.
Request an assessment →Watching from the outside, every day.
Leaked credentials from your domains, imitations of your brand, email and domain security, and an inventory of what you expose to the internet. Nothing to install and nothing of yours gets read: alerts in your portal and a monthly report.
Let's talk →A pentest every month.
Everything in Radar plus monthly offensive testing of everything you expose to the internet, with an agreed scope, a monthly report of what we find and help closing it. All under your written authorisation.
Let's talk →When you need something specific.
A pentest of one application, a phishing simulation for your team, training, regulatory compliance, or forensic analysis after an incident. With a fixed quote.
See the projects →You tell us about your company and we tell you, with no obligation, where we would start and what it would cost.
We agree in writing what we look at, what we test and when, and you sign the authorisation. Without it, we touch nothing.
Radar watches every day; Guard tests every month. Findings land in your portal, prioritised by risk.
Every month, a plain-language report: what we tested, what we found, what to close first and what is already closed. We help you close it, or we close it ourselves if you ask us to.
NIS2, GDPR and Spain's ENS require measures, evidence and follow-up. The monthly report and the cybersecurity dossier give you the evidence, and the control mapping tells you which requirement each action answers — for a large client, an insurer or a tender.
We touch nothing without written authorisation. Every test has an agreed scope and window. What is not in scope is not tested.
We are not a SOC. Nobody is watching screens at three in the morning. We watch every day and test every month; if what you need is 24-hour monitoring, we will tell you.
We do not replace your IT provider. We work with them. We are what you are missing, not what you already have.
We do not promise you will not be attacked. We promise you will know what you had exposed before someone exploits it, and what to do about it.
"We already have an IT provider. Why do we need this?"
Because it is a different job. Your IT provider maintains; we attack, with permission, and tell you what we found. You need both, and we work with them.
"Can the pentest take something down?"
Tests run with an agreed scope, window and limits, and from the outside. If a test could affect a fragile system, we agree it beforehand and, if necessary, skip it.
"What do we need to get started?"
A conversation, the list of what you expose (we help you build it) and the signed authorisation. Nothing to install.
"How much does it cost?"
The assessment and projects come with a fixed quote. Guard is a monthly fee based on scope. We tell you after the first conversation, with no obligation.