Frequently Asked Questions

Do we have to sign a long-term contract?

No. Most of our services are fixed-scope projects with a concrete deliverable. If there's an ongoing relationship, it's formalized through a managed service agreement, always with defined terms and a flexible exit.

Do you work with companies of all sizes?

Yes. We have clients ranging from 5-person startups to IBEX 35 companies. We adapt the scope and price to each organization's circumstances.

What sets QuantumSec apart from other cybersecurity companies?

Offensive specialization and a close working relationship. We're not a generalist integrator. We're a technical team that understands the language of attackers, communicates it in business terms and supports the client throughout the process, not just when we deliver the report.

How do you guarantee confidentiality?

We sign an NDA before starting any work. All access and tests are documented and carried out strictly within the agreed scope.

How soon can you start?

Between one and three weeks from the moment scope is agreed, depending on team availability and the window we agree with you. We work as a boutique team with few concurrent projects, so we give a real start and delivery date before signing rather than an estimate that slips later.

Can we hire a single service, or is a package required?

A single service. Most projects are fixed engagements with a defined scope and price, with no minimum commitment and no lock-in. If it later makes sense to extend — adding a retest, moving from a one-off audit to continuous assessment — we raise it based on the work already done, not up front.

What do we get when the project ends?

Two reports and a meeting. A technical report with every finding, its evidence, reproduction steps and the specific fix; an executive report translating risk into business impact, suitable for the board or for a client that requires it. The closing meeting is for your team to ask questions, not for us to read the report aloud.

When does it make sense to hire a penetration test?

When you need to validate real risk with evidence rather than a theoretical or purely automated assessment: before a launch, after a significant architecture change, when a client or regulation demands it, or when a vulnerability scan has flagged issues nobody has confirmed by exploiting them. If your goal is a compliance tick-box rather than finding out what an attacker could actually do, a pentest is the wrong purchase.

What should I ask a provider before hiring a pentest?

Four things settle most decisions: the CV and certifications of the people who will run the test, not just the company brand; a real anonymized sample report, to check whether they explain business impact or only dump technical findings; the methodology they follow (OWASP WSTG, PTES, OSSTMM); and whether a retest of the fixes is included. A provider that cannot show a sample report or names no methodology is usually selling an automated scan.

How much does a penetration test cost in Spain?

The price depends on the scope: number of IPs, URLs, applications and depth of the analysis. A standard-sized web pentest usually costs between €2,500 and €6,000; an API, between €2,000 and €6,000; and an internal or perimeter network, between €4,000 and €12,000. A red team engagement starts at €12,000. You can get an instant estimate with our pentest cost calculator, and we always start with a free first call to tailor the proposal to your case.

Can pentesting affect the availability of my systems?

We define the scope precisely before starting. By default, we avoid actions that could interrupt the service (DoS, data deletion). If any test carries potential risk, we agree it with you and run it during a maintenance window.

What's the difference between a pentest and a vulnerability assessment?

A vulnerability assessment is an automated scan that detects possible flaws but doesn't verify or exploit them. A pentest goes further: a human expert confirms the vulnerability is exploitable, demonstrates its real impact and assesses whether it allows escalating the attack. The result is far more actionable.

What's the difference between a pentest and ethical hacking?

A penetration test is a technical test scoped to one specific system or surface: a web app, an API, a network. Ethical hacking is a broader assessment that combines multiple vectors — OSINT, external perimeter, internal network, privilege escalation — to simulate a full attack campaign against your organization. If you need to assess a specific system, choose penetration testing; if you want to know how far a real attacker would get across your whole organization, choose ethical hacking.

What information do you need to start?

It depends on the type of test. For a black-box pentest, we only need the URLs or IPs in scope. For a gray-box or white-box test, we may need test credentials, source code access or architecture documentation. We agree everything before starting.

How long does a pentest take?

Between 3 and 10 business days for the technical phase, depending on the scope. The report is usually delivered 2-3 days later. For red team engagements or complex infrastructures, it can take longer.

How do I hire a penetration test for my company?

The process is simple: you describe your environment (URLs, IPs, applications or internal network in scope), we hold a free initial call to understand your needs, and within 24-48 hours you receive a proposal with scope, methodology and price. No fine print, no charges for the initial analysis.

Do you run penetration tests on artificial intelligence systems?

Yes, and it's worth separating two things that often get confused. One is auditing your AI: testing your models, chatbots and LLM agents against prompt injection, jailbreak, context poisoning and model data leakage, following the OWASP Top 10 for LLM and MITRE ATLAS — that's our AI penetration testing service. The other is using AI as a tool to speed up a conventional pentest, which is what AI-powered penetration testing covers. If your company has put a conversational assistant into production, the first one is what you need.

Do you do black-box, gray-box or white-box testing?

All three. Black box simulates an external attacker with no prior information. Gray box includes standard user credentials to assess access control. White box includes access to the code and architecture and allows a more exhaustive analysis. Most clients choose gray box as a balance between realism and coverage.

Do you assess WordPress and other CMSs?

Yes. WordPress is the most attacked CMS in the world precisely because of the proliferation of vulnerable plugins. We assess the core, the installed plugins, the themes, the server configuration and how access to the admin panel is handled.

Can you sign an NDA before starting?

Always. Before you share any data about your infrastructure, we sign a confidentiality agreement.

What happens if you find critical vulnerabilities?

We notify you immediately (same day) if we find something that poses a serious and immediate risk to your business, without waiting for the full test to finish.

Can the pentest run against production, or do you need a staging environment?

It can run against production and usually does, because a staging environment with fake data and a different configuration hides exactly what is worth finding. What gets agreed beforehand is the intensity profile, an execution window for tests that may generate load, and a direct contact line to stop mid-run if anything degrades. Potentially destructive tests are discussed with you before they are run, never after.

What do you need to start: credentials, source code, documentation?

It depends on the testing model agreed (black, gray or white box). Black box needs only the URL and written authorization. Gray box — the most cost-effective option for an application with users — needs two accounts per distinct role, because without them authorization between users cannot be tested, and that is where the highest-impact findings appear. Source code is only required if a static code review is also part of the engagement.

How is this different from running a vulnerability scanner?

A scanner finds what is already cataloged: outdated versions, missing headers, known patterns. It does not find broken business logic, which is specific to your application: a discount that can be applied twice, someone else's order whose status can be changed, a payment flow that can be completed while skipping a step. That requires understanding what the company actually does, which is why no tool automates it.

How long does a web pentest take?

The technical phase usually takes 3 to 10 business days, depending on the number of roles, flows and features, and the report arrives 2-3 days later. The exact timeline is set in the proposal, with fixed scope and price.

How often should it be repeated?

At least once a year and always after a significant change: a new feature that handles sensitive data, a change of authentication or provider, or a migration. Between pentests, recurring vulnerability assessment keeps watch over cataloged flaws.

Do you need access to the API documentation (Swagger/OpenAPI)?

It's useful but not essential. We can work in black-box mode by intercepting the traffic of the application that consumes the API. Documentation speeds up the process and improves coverage.

Do you audit internal APIs or only internet-facing ones?

Both. In fact, internal APIs are frequently the most vulnerable because of the mistaken assumption that "only employees use them." Lateral movement in an attack usually leverages exactly this type of API.

What's the difference between auditing a REST API and a GraphQL one?

GraphQL has specific attack vectors: introspection can reveal the entire data schema, batching enables application-level DoS, and field-level authorization is harder to implement correctly. We cover both with adapted methodologies.

How long does an API audit take?

Between 3 and 7 business days for the technical phase, depending on the number of endpoints and the complexity of the authentication and business flows.

Do you need the API documentation, or can you work without it?

We can work without it, but the result is poorer and costs more. With an OpenAPI specification or a Postman collection the scope is covered from day one; without it, time goes into discovering endpoints, and whatever is not discovered is not tested. If the documentation is out of date, tell us: an endpoint that exists and is undocumented is itself a relevant finding.

Do you cover GraphQL as well as REST?

Yes, and the approach differs considerably. In GraphQL what matters is introspection left exposed in production, depth and query-complexity attacks that exhaust the server, and field-level authorization: protecting the type but not each field is common, so a nested query returns data the user should not see. In REST the emphasis is more on object-level authorization and identifier enumeration.

How do you avoid exhausting rate limits during testing?

It is agreed beforehand: either the source IP is excluded from rate limiting during the testing window, or intensity is tuned to stay below the threshold. It is worth deciding deliberately, because disabling the limit allows everything else to be tested thoroughly but leaves the abuse control itself unevaluated, and on an exposed API that is a finding in its own right. The usual approach is to test both scenarios at different times.

Do you need the app's source code?

It is not essential. We can work from the binary alone (APK or IPA) for the static analysis. Source code, when available, allows a deeper and more efficient review.

Do you audit both iOS and Android apps?

Yes. We work with both platforms. iOS requires jailbroken devices or the use of the simulator for certain dynamic analyses. Android is easier to analyze with emulators.

How does it affect publishing to the app stores?

Not directly. The audit is carried out on a test build or the production version already published. Fixes are implemented before the next release.

Can you audit just the API without analyzing the app?

Yes. If your app has already been audited or your concern is the backend, we can focus solely on the API. See our API pentesting service.

Do you need admin access to run the audit?

Not necessarily. We can start with a standard user account to simulate exactly what an attacker who has compromised a workstation would do. Depending on the agreed scope, we can escalate to higher privileges in a controlled way.

What impact does the audit have on the production environment?

Minimal. By default we avoid any destructive action or anything that could cause mass account lockouts or service interruptions. Everything is agreed in advance.

Do you also harden AD once the problems are identified?

The audit includes detailed remediation instructions. If you need us to implement the fixes directly, we can quote it as an additional service.

How often should Active Directory be audited?

At least once a year and after major infrastructure changes (migrations, new business units, mergers). More dynamic environments should do it every 6 months.

What's the difference between an audit and a penetration test?

Penetration testing focuses on exploiting vulnerabilities to confirm their real impact. An audit has a broader scope: it reviews configurations, policies, regulatory compliance and overall security posture, not just exploitable technical vulnerabilities.

Can you audit just one specific part?

Yes. We can limit the scope to a single application, a network segment, the code of a specific module or a cloud provider's configuration. We have no mandatory minimum scope.

Can the report be presented to clients or regulators?

Yes, as long as the regulator accepts third-party reports. We structure it with the formality needed for that purpose. If the regulator requires a specific format, we can adapt it.

How long does a cybersecurity audit take?

It depends on scope. An audit limited to one application or one network segment is usually completed in 5 to 10 business days, report included. A broad scope covering infrastructure, applications, code and processes takes three to six weeks. The delivery date is fixed before we start, not as we go.

What do you need from us to get started?

A technical point of contact, the inventory of assets in scope, and the necessary authorizations if third parties are involved (hosting, cloud provider, external developer). For internal or source code audits, the corresponding access. Nothing else: the preparation work is on us.

Does it include a second review after we fix the findings?

Yes. We include a retest of the corrected findings within an agreed window after delivery. An audit with no follow-up verification leaves unchecked the only thing that matters: that the fix works and has not opened a new problem.

How do you handle the information you get access to?

Under a confidentiality agreement signed before we start. Project data is handled in controlled environments, is never reused on other engagements, and evidence is retained only for the period set out in the contract. Any personal data accessed during the audit is processed in line with the GDPR and Spain's LOPDGDD.

Will employees know it's a simulation?

Not during the campaign. The learning effect is much greater when the employee discovers, after clicking, that it was a test. It's handled with care: employees aren't publicly identified or penalized, only trained.

Do you need access to our email server?

We need our sending infrastructure to be whitelisted so emails reach inboxes correctly. It's a simple technical process we manage together with you.

What happens to the data on who clicked?

Data is handled with strict confidentiality. The report can be presented anonymized by department if you prefer, without identifying individual employees.

How often should these simulations be run?

The recommended minimum is 2-3 campaigns per year. Awareness fades over time if it isn't reinforced. Ideally it's complemented with short, periodic training modules.

Is NIS2 already in force in Spain?

The directive was due to be transposed by October 17, 2024, and Spain missed the deadline: the draft Law on the Coordination and Governance of Cybersecurity was approved in January 2025, but as of October 2026 it has not been published in the BOE (Spain's Official State Gazette), and the European Commission referred Spain to the Court of Justice of the EU in July 2026. Meanwhile there is no NIS2 penalty regime applicable to companies and Royal Decree-Law 12/2018 still applies. The obligations will arrive with the law and compliance takes months, which is why it pays to start before it is published.

What are the penalties for NIS2 non-compliance?

For essential entities: up to €10 million or 2% of global annual turnover, whichever is higher. For important entities: up to €7 million or 1.4% of global turnover.

How does NIS2 differ from the previous NIS1 directive?

NIS2 expands the sectoral scope, increases reporting obligations (notification within 24/72 hours), raises penalties, includes personal liability for management bodies and adds supply chain requirements.

Do we need a pentest to comply with NIS2?

NIS2 requires assessing security risks and applying appropriate technical measures. Penetration testing is one of the most solid ways to meet that obligation in a documented and verifiable way.

How long does it take to comply with NIS2?

It depends on your starting point. Companies with a solid security baseline can complete the process in 3-6 months. Organizations starting from scratch may need 12-18 months for full compliance.

What timeline does NIS2 compliance follow in Spain?

Right now the timeline is set not by a date in the Spanish law, which has yet to be published, but by two things: your starting point and your customers, who, if they are regulated entities, are already passing requirements down by contract. We recommend closing the applicability analysis and the gap analysis within 4 to 6 weeks, so you have a plan with defensible deadlines on the day the law comes into force, even if implementation then runs for several months.

What is the difference between being in scope as an essential or an important entity?

The Article 21 security requirements are the same for both. What changes is supervision and the penalty regime: essential entities face proactive supervision and fines of up to €10 million or 2% of global turnover; important entities face reactive supervision — after an incident or a complaint — and fines of up to €7 million or 1.4%. Determining the correct category is part of the applicability analysis.

How does DORA differ from NIS2?

NIS2 is a horizontal directive affecting multiple sectors. DORA is a sector-specific regulation for the financial sector, with more detailed and technical requirements, especially regarding resilience testing (TLPT) and ICT provider management.

What is TLPT testing and who must perform it?

TLPT (Threat-Led Penetration Testing) is advanced penetration testing based on real threat intelligence, targeting the entity's most critical systems. It's only mandatory for significant entities designated by the competent authorities. We can run it with the TIBER-EU methodology.

Does DORA also affect technology providers of financial entities?

Yes. DORA establishes a direct oversight regime for critical ICT providers. And even if you're not a critical ICT provider, if you're a technology provider to a financial entity, they will require you to include DORA contractual clauses in the service agreement.

When does DORA become enforceable?

It has applied since January 2025, so there is no grace period ahead: the obligations are already enforceable for entities in scope. What is still under way is the rollout of supervision and the designation of entities for advanced testing, which comes through a communication from the competent authority. Not having received that communication does not exempt you from the rest of the regulation.

What about our ICT providers?

Through your contracts. DORA requires maintaining a register of information on ICT providers, including minimum clauses in contracts — audit rights, service levels, incident notification, cooperation with the supervisor — and holding a documented exit strategy for those supporting critical functions. Those designated as critical providers also come under direct European oversight, but that is the authorities' decision, not yours.

Does TLPT apply to us, or is the general testing program enough?

Every entity in scope must have the general testing program. TLPT — threat-led red teaming, at least every three years — is only required of entities the competent authority designates based on size, risk profile and systemic relevance. In Spain the authority is the Banco de España, the CNMV or the DGSFP depending on entity type, and the reference framework is TIBER-ES.

What exactly does the auditor check in an ENS audit?

For MEDIUM or HIGH category, conformity is demonstrated through a formal audit that goes through the Annex II measures of Royal Decree 311/2022 in three frameworks: the organizational framework (security policy, rules and procedures), the operational framework (planning, access control, operations, continuity) and the protection measures (facilities, personnel, equipment, communications and information). It does not stop at checking that a document exists: it asks for evidence that the measure is actually operating. That is why our preparation reproduces that review before the certification body arrives.

What types of ENS audit are there, and which one does my system need?

It depends on the system's category (Annex III of Royal Decree 311/2022). The BASIC category needs no audit: a documented self-assessment, which the staff who administer the system or someone they delegate to can carry out, is enough to issue the declaration of conformity. MEDIUM and HIGH require a formal audit to obtain the certification of conformity, issued by an accredited certification body. In every case, Article 31 requires the audit to be repeated at least every two years, and on an extraordinary basis whenever the system changes substantially. We carry out the delegated self-assessment for BASIC and, for MEDIUM and HIGH, the pre-audit that reproduces the auditor's review so certification passes on the first attempt.

What's the difference between an ENS declaration of conformity and certification?

The declaration of conformity is an internal document the entity itself issues stating that it complies with the ENS. Certification is issued by a certification body accredited by ENAC after a formal audit. Some public contracts require certification, others accept the declaration.

How often must ENS certification be renewed?

ENS certification is valid for 2 years, with annual follow-up audits.

What if the systems are BASIC category?

BASIC category systems have a less demanding but equally mandatory set of measures. Conformity can be demonstrated through a properly documented internal audit.

Can I hire QuantumSec for the ENS audit, or does it have to be an official body?

Formal ENS certification must be issued by an ENAC-accredited certification body. Our service is the preparatory consulting: gap analysis, system classification, implementing controls and preparing all documentation so the certification audit passes on the first attempt.

Which bodies can certify the ENS?

Any certification body accredited by ENAC specifically for the ENS scheme, such as AENOR, Bureau Veritas or DNV. We don't issue the certificate ourselves — the accredited body does, after the formal audit — but we help you choose and prepare all the documentation and evidence that audit will require.

How long does ENS compliance take?

For a BASIC category with the infrastructure already in order, between 6 and 10 weeks to the declaration of conformity. For MEDIUM or HIGH with certification by an accredited body, the realistic range is 4 to 8 months: the bulk of the work is not the documentation but implementing the missing technical measures and accumulating the operating evidence the auditor will ask for.

Do I need the ENS if I am only a supplier to a public body?

In practice, yes. Royal Decree 311/2022 extends the obligations to private-sector operators providing services to public entities, and the level required is inherited from the category of the system you serve. Companies often discover this when reading the tender documents: ENS conformity appears as a technical qualification requirement, not as something that merely earns extra points.

How does the ENS relate to NIS2?

They overlap across much of the technical control set but do not replace each other. The ENS is the Spanish framework for the public sector and its suppliers; NIS2 is the European directive for essential and important sectors. If you already have the ENS in place, much of the NIS2 work is done — risk management, incident logging, continuity — but NIS2 adds obligations of its own, such as direct accountability for the management body.

Is a penetration test required for ENS compliance?

For HIGH category, yes: the R6 reinforcement of the monitoring measure [op.mon.3] requires periodic penetration testing of the systems in scope. For MEDIUM, recurring vulnerability assessment usually suffices, although the auditor may ask for evidence of deeper testing depending on the type of service. For BASIC it is not mandatory, but it is the fastest way to find out which declared measures are not actually working.

Can network pentesting disrupt my services?

Under normal conditions, no. We agree on the scope and exclude disruptive actions. The more aggressive tests are scheduled within maintenance windows. If you operate 24/7, we define windows outside peak hours.

What is the difference between an internal and a perimeter audit?

The perimeter audit analyzes what an external attacker sees from the internet: open ports, exposed services, DMZ configuration. The internal audit simulates an attacker already inside —a malicious employee, a stolen credential— and that is where the most critical findings appear.

How often should I audit the network?

At least once a year, and whenever there are significant changes to the infrastructure: new sites, a change of provider, a cloud migration or an expansion of the corporate Wi-Fi network.

What network size can be audited?

We audit everything from networks of 20 hosts to enterprise environments with thousands of devices. The scope and price are tailored to the real size of your infrastructure.

Do we have to give you access to the repository?

Yes, we need read access to the repository. We sign an NDA beforehand and all access is documented. You can create a dedicated branch or fork for the review if your policy requires it.

Which languages and frameworks do you support?

JavaScript/TypeScript (Node.js, React, Angular, Vue), Python (Django, FastAPI, Flask), Java (Spring), PHP (Laravel), Ruby (Rails), Go and .NET (C#). If you work with another stack, ask us.

How long does it take?

Between 3 and 8 business days depending on the codebase size. A 30,000-line project can be reviewed in about 4 days. Larger projects require more time or a review focused on critical modules.

Do you also review infrastructure as code (IaC)?

Yes. We review Terraform, CloudFormation, Kubernetes manifests and Dockerfiles to detect insecure configurations in infrastructure defined as code.

What happens if an employee falls for the phishing attempt?

Nothing negative. The goal is educational, not punitive. The employee will see a notice page explaining they just took part in an exercise and what signs they should have noticed.

How often should this be done?

At least twice a year to maintain alertness. Organizations with higher exposure or that handle sensitive data should do it quarterly.

Can we exclude certain departments?

Yes. We can segment the scope by department, access level or any criteria you need.

Could this end up singling out individual employees?

No, and the exercise is deliberately designed to prevent it. Results are delivered aggregated by department or profile, never as a list of who fell for it. The goal is to measure the organization's resilience and the effectiveness of its controls, not to build a case file. An exercise used to single people out destroys the trust needed for staff to report incidents, which is exactly the capability you want to strengthen.

Do we have to tell staff an exercise is coming?

Announcing that simulations will take place at some point during the year is advisable and is often required by applicable labor and data protection rules. Announcing the specific date destroys the measurement. The usual balance is to state in the security policy that periodic exercises are run, without detailing when or with what pretext, and to agree the scope with HR and employee representatives before starting.

What click rate is acceptable?

The click rate on its own says little, because it depends enormously on how plausible the pretext is: a generic email and one built from real company information give incomparable results. The metrics that do guide you are the reporting rate — how many people alert the security team — and time to first report. An organization with clicks but fast reporting is in better shape than one with no clicks and no alerts at all.

Can you help us with several regulations at once?

Yes, and it makes sense to do so. Many controls in ISO 27001, NIS2 and DORA overlap. Handling them in an integrated way avoids duplication and reduces overall effort.

Do you also run the certification audit?

We're not a certification body (that requires ENAC accreditation), but we work with the main certification bodies and support you throughout the process.

How long does a compliance project take?

It depends on the regulation and your starting point. A gap analysis takes 2-4 weeks. A full ISO 27001 project from scratch takes between 6 and 12 months for an SMB.

Is the ENS mandatory for private companies?

The ENS is mandatory for public administrations and private companies that provide ICT services to the administration or process publicly owned data.

Where do we start if we do not comply with anything yet?

With an assessment, not with the paperwork. First establish which regulations actually bind you and which category you fall into, then measure the real distance between what you do and what is required. Writing policies before knowing that produces folders that fail an audit and reduce no risk.

What if we are audited before the compliance work is finished?

Having a documented compliance plan, with milestones and owners, is a defensible position with a supervisor; having nothing is not. That is why the first deliverable is always the risk-prioritized plan: if the audit arrives early, you can show what is done, what is in progress and on what basis you sequenced it.

How much of what NIS2 requires also counts toward ISO 27001 or the ENS?

Considerably more than people assume. Risk management, access control, incident handling, business continuity and supplier security appear in all three frameworks with different wording and the same substance. The efficient route is to map the shared controls once and document separately only what each regulation specifically demands. Running three full frameworks in parallel multiplies cost without adding compliance.

ISO 27001:2013 or ISO 27001:2022? Do we need to migrate?

The current version is ISO 27001:2022. Certificates issued under the 2013 version had until October 2025 to migrate. If you're just starting, go straight for the 2022 version.

How many internal resources does the project require?

You need an internal owner (usually the CISO or IT manager) with around 4 to 8 hours per week. The technical team takes part occasionally during the implementation of controls.

Does the ISO 27001 certificate have an expiration date?

The certificate is valid for 3 years, with annual surveillance audits (years 1 and 2) and a recertification audit in year 3.

Can you look after the ISMS after certification?

Yes, except for the surveillance audit itself, which the same certification body carries out every year. What we do is everything that audit will review: the internal audit required by clause 9.2, the management review, updating the risk assessment and the Statement of Applicability as the business changes, and preparing the year-three recertification.

How long does it take to implement ISO 27001 through to certification?

With a narrow scope (one product, one service or one site), 3 to 6 months to the certification audit; with broad scopes or several sites, 6 to 12 months. What stretches the project is not writing the policies but giving the controls enough time in operation to produce the records the auditor will want to see in Stage 2.

Which certification body do you work with?

We don't issue the certificate ourselves: due to role incompatibility, whoever helps you implement the ISMS cannot also certify it. We support you in choosing among ENAC-accredited bodies — AENOR, Bureau Veritas, DNV and others — and provide technical support throughout the external audit, whichever one you choose.

Does AI pentesting affect the model's performance in production?

No. Testing is carried out in a staging environment or with controlled traffic. We never interfere with real users or degrade the service.

Do I need access to the model or only to the interface?

It depends on the scope. A black-box test only requires access to the final interface. A full pipeline test requires access to the system code and the model configuration.

Do you cover open-source models deployed on-premises?

Yes. We assess both cloud models (OpenAI, Anthropic and Google APIs) and open-source models (Llama, Mistral, Qwen) deployed on your own infrastructure.

Do you assess AI agents and MCP servers?

Yes. An agent connected to several MCP servers inherits the trust of whichever tool is weakest. We test for tool poisoning, privilege escalation across connected tools, and exfiltration through a legitimate output channel (posting a message, sending an email, opening a PR).

Do you need admin credentials for cloud pentesting?

For a complete test, yes, we need an account with read permissions over all services. We can also perform a black-box test from the internet to assess external exposure. We recommend combining both approaches.

Can pentesting affect my production services?

We coordinate all tests to minimize impact. Destructive exploitation (deletion, data modification) always requires explicit approval and is done in test environments.

Do you cover multi-cloud architectures?

Yes. We have experience in environments combining AWS, Azure and GCP, as well as hybrid cloud + on-premises configurations.

What permissions do you need on our cloud account?

A read-only role over the configuration is enough for the review part: in AWS that maps to SecurityAudit or ViewOnlyAccess, with equivalents in Azure and GCP. For the offensive part — checking whether a specific identity can escalate privileges — a test identity with deliberately limited permissions is also needed, and it is precisely the one that demonstrates how far somebody compromising a low-privilege account can get.

Do we need to notify the cloud provider before testing?

The major providers now allow most testing against your own resources without prior authorization, but they keep exceptions — mainly denial-of-service and saturation testing — that do require permission or are outright prohibited. We review the provider's current policy when defining scope and put in writing what is in and what is out, because those policies change.

Does this replace the cloud security posture tools we already have?

No, it complements them. A posture tool tells you which configurations deviate from a baseline, and it does that better and continuously. What it does not do is chain findings: check whether that specific configuration, combined with that role and that function without a private network, lets an attacker get from a public bucket to production credentials. The value of the exercise is in the chain, not in the isolated finding.

Do you need physical access to the device?

For a full test, yes. The cloud API, the mobile app and network communications can be tested remotely, but hardware and firmware analysis needs the device in our lab.

How many units do you need?

Ideally two or three: some hardware tests may require desoldering components or may leave a unit unusable. If there is only one, the plan starts with non-destructive techniques and any step that could damage it is agreed with you first.

Do you need the firmware or the source code?

It's not essential: extracting the firmware from the board itself is part of the test, because that's what an attacker would do. If you provide it, along with schematics or code, the analysis goes further in the same time.

What does the Radio Equipment Directive require of a connected device?

Since 1 August 2025, Delegated Regulation (EU) 2022/30 requires radio equipment that connects to the internet, and some that processes personal data or enables payments, to meet cybersecurity requirements. The EN 18031-1, -2 and -3 standards are the route to a presumption of conformity. A penetration test provides technical evidence that those requirements are actually met, beyond the paperwork.

And the Cyber Resilience Act?

The CRA applies to almost any product with digital elements sold in the EU. From 11 September 2026 manufacturers must report actively exploited vulnerabilities to ENISA, and on 11 December 2027 it becomes fully applicable, with requirements for security by design, vulnerability handling and updates throughout the product lifetime.

Can you run the test without affecting industrial production?

Yes. In OT environments we work with the plant team to set maintenance windows, favour passive techniques and run the most invasive tests on spare equipment or a test bench, never blindly against a live process.

Can the report be used in the product's technical file?

Yes, as evidence of security testing: each finding states what was tested, how, the result and the reference to the relevant standard, and the retest documents that the fixes work. The conformity assessment itself is carried out by the manufacturer or, where required, a notified body.

How long does an IoT penetration test take?

It depends mainly on how many layers are in scope (hardware, firmware, radio, app, cloud) and how many units there are. We set it in the proposal, with fixed scope and price, after a first call in which we look at the device and its ecosystem.

Do you need the source code or just the app?

We can work with just the build (black or gray box), the way an attacker would. If you also give us the code, the analysis goes further in the same time and the recommendations point to the exact line. For teams that want to fix things fast, we recommend it.

How do we get the app to you for testing?

The simplest route is a test build through TestFlight or a development-signed IPA, along with test accounts for each role. If the app is only available publicly, we can also work with the App Store version.

Do you need a jailbroken device?

For full dynamic analysis, yes: we provide it. Part of the static and network analysis can be done without a jailbreak or on a simulator, but many storage and authentication flaws only show up on a real device.

Does it include the API the app uses?

Yes. Most of an app's serious findings are in its backend: endpoints that return other users' data or accept what the app should already have validated. The API is part of the same scope.

What is OWASP MASVS and what level do we need?

It's OWASP's mobile application security verification standard, organised into eight categories: storage, cryptography, authentication, network, platform, code, resilience and privacy. Since version 2 it no longer defines L1 and L2 levels within the standard: scope is tuned with the OWASP MAS project's testing profiles according to the app's risk, and we agree it with you in the proposal.

Do you test the Android version too?

Yes, and it makes sense to do it in the same project: they share the API and logic, but each platform has its own flaws. Testing both together avoids paying twice for the backend analysis.

How long does an iOS app pentest take?

It depends on the number of features and roles and whether the API is in scope. The technical phase of a pentest usually takes 3 to 10 business days and the report arrives 2-3 days later; the exact timeline is set in the proposal.

Do you need the source code of the Android app?

It's not essential: we can work with the APK or AAB, the way an attacker would. Source code lets us go further in the same time, especially on business logic, and point recommendations to the exact line.

Can you run the test without a physical device?

Part of the static and network analysis can be done on an emulator. For full dynamic analysis with Frida, and for anything hardware-dependent such as the Keystore or biometrics, we use rooted physical devices that we provide.

Do you test the obfuscated production app?

Yes. Obfuscation with R8 or commercial tools makes analysis harder but doesn't prevent it, and measuring how costly it is to get past is precisely part of resilience testing. If you want more depth in the same time, an unobfuscated build helps.

Does the assessment help with GDPR compliance?

Yes. We identify where personal data is stored and transmitted, whether it is properly protected and which permissions are unnecessary. That information is key to the data protection impact assessment (DPIA) and to making sure the Google Play data safety section tells the truth.

How long does an Android app pentest take?

It depends on the number of features and roles and whether the API is in scope. The technical phase of a pentest usually takes 3 to 10 business days and the report arrives 2-3 days later; the exact timeline is set in the proposal.

Is the CTI service continuous or one-off?

It's an ongoing monitoring service. One-off intelligence (an exposure report or an analysis of a specific threat actor) is also available as an ad-hoc service.

How does CTI integrate with our existing security systems?

We provide feeds in standard formats (STIX/TAXII, CSV, JSON) that integrate with major SIEMs (Splunk, Microsoft Sentinel, QRadar) and SOAR platforms.

What's the difference between CTI and OSINT?

OSINT is a source (information from open sources). CTI is a full process: collection from multiple sources (OSINT, dark web, private feeds), analysis, contextualization and production of actionable intelligence for decision-making.

Do you need to be physically on our premises?

For the full assessment, yes. Wireless network analysis requires physical presence. We schedule visits at times that minimize disruption to your operations.

Does the WiFi audit include guest networks?

Yes, we include every wireless network within the perimeter: corporate, guest, IoT and any unauthorized network we detect.

Do you also assess the security of devices connected to the WiFi?

The standard scope covers the wireless infrastructure. If you want to include an assessment of connected devices (IoT, PCs, printers), we extend it as part of an internal network pentest.

Does somebody need to come to our offices in person?

Yes. A serious WiFi audit requires physical presence, because much of what is assessed depends on real signal propagation: how far it reaches from the street or the parking lot, what is visible from a waiting room, whether an unauthorized access point would go unnoticed. What can be prepared remotely is the review of controller configuration and network documentation.

Will the network go down during testing?

Under normal conditions, no. Most of the work is passive: capture, observe and analyze. The tests that can affect service — deauthenticating clients to capture a handshake, or standing up a twin access point — are agreed beforehand and run in a scheduled window, usually outside peak hours. They are never launched unannounced.

We already have WPA3. Do we still need the audit?

WPA3 closes specific attacks against the previous protocol, but not the ones most exploited in practice. Most findings in a corporate WiFi audit are not cryptographic: they are segmentation issues — a guest network that reaches the internal one — unauthorized access points plugged in by somebody inside the company, shared credentials that never rotate, and legacy devices that force compatibility modes which cancel out the improvement.

What's the difference between an MSSP and an IT maintenance contract?

An MSSP focuses exclusively on security: threat detection, vulnerability management, incident response and regulatory compliance. We don't manage infrastructure or end-user support.

What's the SLA for incident response?

For critical incidents, the initial response time is under 4 hours. For high-impact incidents, we guarantee forensic analysis begins the same day.

Does the service include the annual pentest?

Yes, mid-tier and higher plans include an annual pentest with an agreed scope. It's the ideal combination: continuous monitoring plus periodic offensive assessment.

Is AI-powered pentesting as rigorous as manual testing?

It is more rigorous in coverage (AI does not tire and never skips steps) and less so in pure creativity. That is why we combine both: AI guarantees systematic coverage while the human expert brings creativity, context and advanced exploitation.

Which AI tools do you use?

We combine proprietary tooling with recognized industry solutions, tailored to each type of assessment. We do not rely on a single vendor or on generic AI tools that have not been validated for security work.

Is it cheaper than traditional pentesting?

Generally yes, because automation reduces the hours spent on manual reconnaissance. But the main value is not the cost: it is the broader coverage achieved in the same amount of time.

How do you avoid the false positives AI produces?

No finding reaches the report without manual validation. AI widens reconnaissance coverage and groups evidence, but confirming that something is exploitable is done by a pentester reproducing the attack. A report full of false positives makes the development team stop reading it, and that costs more than not automating at all.

Is our data sent to third-party models?

Not without prior written agreement. Scope, tooling and data handling are agreed before the engagement starts. When an exercise requires processing sensitive client information, where it is processed and under what conditions is agreed in advance and written into the contract alongside the NDA.

Which part of the work is still human?

The part that decides. AI speeds up reconnaissance, data correlation and initial prioritization; the pentester defines scope, designs the attack chains, exploits business logic and judges real impact on your operations. Broken business logic remains the finding no tool discovers on its own, because it requires understanding what the company actually does.

Is a vulnerability assessment enough to comply with NIS2 or ISO 27001?

It depends on the required maturity level. NIS2 and ISO 27001 require continuous vulnerability management, which a recurring VA can cover. To demonstrate real impact or for red team assessments, pentesting is required.

How often should I run a vulnerability assessment?

We recommend a monthly cycle for critical assets and quarterly for the rest. After significant infrastructure changes (a new application, cloud migration, etc.) we always recommend a one-off assessment.

Does the VA include web applications?

Yes. The scope can include network infrastructure, servers, web applications and APIs. We also offer the vulnerability assessment as a first step before a full web pentest.

How is it different from a penetration test?

A vulnerability assessment identifies and classifies known weaknesses in an automated, recurring way, with manual validation of the relevant findings. A penetration test goes further: it exploits those weaknesses, chains flaws together and demonstrates real business impact. The assessment answers what you have exposed; the pentest answers how far an attacker can actually get.

How do you prioritize the findings?

We combine three signals instead of relying on theoretical severity alone: CVSS for technical impact, EPSS for the probability of exploitation in the next 30 days, and the CISA KEV catalog for what is already being exploited. A CVSS 9.8 with no observed exploitation is rarely more urgent than a 7.5 with a public exploit in circulation.

What do you do about false positives?

We discard them before the report reaches you. A scanner with no human review produces noise that eventually kills the process: the team stops reading the reports. We manually validate high- and medium-severity findings, and we document why anything we discard was discarded.

Can scanning affect system performance?

We work with intensity profiles matched to the environment and agree execution windows for sensitive assets. In production we use non-intrusive configurations by default. If a specific test carries a risk of downtime, we check with you before running it, never afterwards.

What's the difference between external ethical hacking and a network pentest?

External ethical hacking focuses exclusively on what's visible from the internet, starting from zero (no credentials or prior access), including OSINT. A network pentest covers both the external perimeter and the internal network.

Does it include OSINT on employees?

Yes, within the agreed scope. We identify employee data exposed in breaches, LinkedIn and other sources that a real attacker would use for targeted attacks or credential stuffing.

Can it detect if we've already been compromised?

An active compromise assessment is a different service. However, if during reconnaissance we detect indicators of prior compromise, we notify you immediately.

What starting point is used for internal ethical hacking?

We typically simulate a standard domain user (the most realistic scenario: a compromised employee or an attacker with initial access via phishing). We can also start from physical network access (a network cable) or from an unprivileged account on a workstation.

Can the test affect production systems?

We coordinate all testing with the IT team. The most invasive techniques (such as modifying AD) are only performed with explicit authorization and within agreed windows. The goal is to simulate an attack, not to cause damage.

What is BloodHound and why does it matter?

BloodHound is the industry-standard tool for analyzing Active Directory relationships and finding privilege escalation paths. Attackers use it; so do we, so you can see exactly what they would see in your AD.

How much does cybersecurity cost for an SMB?

It depends on your size and exposure. An initial diagnostic and a basic vulnerability assessment can run a few hundred euros. A managed security service for a typical SMB ranges from €300 to €800/month. We always start with what has the most impact for the lowest cost.

Am I required to comply with NIS2 as an SMB?

It depends on your sector and size. NIS2 applies directly to medium-sized and large companies in essential and important sectors. However, many SMBs are indirectly bound by it because they supply companies that must comply, and those companies require security guarantees from them.

Can you help us even if we don't have an IT manager?

Yes. We work directly with management or whoever usually looks after IT at the company. No prior technical knowledge is required to work with us.

How long does it take to set up a cybersecurity plan for my SMB?

The highest-impact immediate measures (MFA, passwords, backups) are set up within days. An initial vulnerability assessment takes 1 to 5 business days depending on size. A full plan with assessment, guided remediation and basic policies is usually completed in 4–8 weeks. We always start with what has the most impact at the lowest cost.

My company has already suffered a cyberattack. What do I do now?

The first step is containment: isolate the affected systems, revoke compromised access and preserve evidence without altering it. Next, a basic forensic analysis determines how they got in, what was affected and whether they're still inside. If the incident involves personal data, you have 72 hours to notify the AEPD. Contact us: we carry out an initial triage to help you understand the situation before deciding next steps.

Do I need a CISO or an in-house security manager?

For most SMBs it's neither necessary nor viable. A senior in-house CISO is a high fixed cost and a hard profile to recruit and retain. The alternative is a virtual CISO service or an external security partner: you set the objectives, we execute them and report back periodically. It's far more efficient for companies with fewer than 100 employees.

What is managed security and when does it make sense for an SMB?

It's a continuous monitoring and response service (SOC as a Service) without hiring an in-house team: we watch your systems, detect incidents and act according to protocols agreed with you. It makes sense once you have critical assets to protect outside business hours but not the volume to justify an internal SOC.

Do I need cyber insurance on top of cybersecurity services?

They're complementary, not substitutes. Most insurers require minimum controls (MFA, backups, periodic vulnerability assessment) to issue or renew a cyber policy, and lower the premium if you can demonstrate them. We help you identify what your insurer requires and implement it before renewal.

When is the best time to do a first penetration test?

The first pentest should happen when the product is in beta or before public launch. Waiting until you have traction or real users increases both the risk and the cost of remediation.

Can you help us complete an enterprise customer's security questionnaire?

Yes. It's one of the services most requested by startups. We help you answer security questionnaires (CAIQ, SIG, custom questionnaires) and put together the documentation that backs up those answers.

Do you have experience with startups using AI-generated code or vibe coding?

Yes. Code generated by LLMs tends to reproduce known vulnerability patterns (injections, insecure secret handling, weak validation). We have a dedicated review service for AI-generated code.

Is AI-generated code less secure than code written by humans?

Not necessarily, but it introduces different risks. LLMs are very good at reproducing known patterns, but that includes insecure patterns too. The biggest risk is "vibe coding": the developer doesn't understand the code and can't identify the security issues.

Do you need access to the full repository?

Yes, a complete analysis requires read access to the source code. We work with GitHub, GitLab and Bitbucket, and we sign an NDA before any access.

Can you audit code generated with Cursor, Devin or other AI tools?

Yes. The specific AI generation tool matters less than the vulnerability pattern in the resulting code. We evaluate the code regardless of which tool generated it.

I have no developer or technical team. Can you still audit it?

Yes. We need the application URL and, where it exists, read access to the builder project or the repository. Many of the failures typical of these applications — a database reachable from the browser, keys sitting in the front-end code, other accounts' data on display — are detectable from the outside, without touching the code. The report is written in plain language and, if needed, we walk whoever applies the fixes through it directly.

Do you audit apps built with Lovable, Bolt or v0, or only Copilot code?

Both, though the work differs. With a copilot such as Copilot or Cursor there is a repository and the audit resembles a classic code review. With an app builder such as Lovable, Bolt, v0 or Replit, the flaw is rarely in a specific line: it sits in the configuration the builder left open by default, especially in the data layer and in permissions between users. There we assess the deployed application, not just the code.

How is cybersecurity consulting different from a pentest?

A pentest is a technical test that looks for exploitable vulnerabilities in a specific system. Cybersecurity consulting is a broader service that assesses the organization's overall maturity: technical controls, processes, people and regulatory compliance. Consulting often leads to identifying a pentest as the necessary next step, but not always.

How much does cybersecurity consulting cost?

It depends on the scope and size of the organization. An initial diagnostic engagement for an SMB can start at €2,500. A broader project with a full roadmap and implementation support can range between €8,000 and €25,000. We always provide a fixed quote before starting.

Can you act as an external CISO after the consulting engagement?

Yes. We offer CISO as a Service (CISOaaS) for companies that need security leadership without the cost of a full-time hire. It includes oversight of the roadmap, attendance at executive committee meetings and strategic security decision-making.

Does the consulting cover NIS2 compliance?

Yes. We carry out the gap analysis against NIS2, identify whether your company is in scope (regulated sectors), assess existing measures against the directive's requirements and prepare a compliance plan with the necessary technical and organizational controls.

Do I need my own technical team to work with you?

No. We work with companies that have an in-house IT team and with companies that have no technical resources of their own. We adapt the language, level of detail and support to each client's reality.

Do you hold in-person meetings in Valencia?

Yes. We're based in Valencia and can meet in person for the initial call, results presentation or training sessions. Technical execution is carried out remotely or on-site depending on the scope of the service.

Which municipalities in the Valencia region do you cover?

The whole Valencia region. Our office is in the city of Valencia and from there we travel routinely to the metropolitan area (Paterna, Torrent, Manises, Burjassot, Mislata), La Ribera (Alzira, Algemesí, Carcaixent), La Safor (Gandia, Oliva), the coast (Cullera, Sueca, Sagunto, Dénia), La Costera (Xàtiva, Canals) and La Vall d'Albaida (Ontinyent). We also serve companies in Castellón and Alicante. We don't have an office in every municipality: we have one base in Valencia and a team that travels, which is what keeps the relationship direct without inflating the cost.

Do you work only with large companies or also with Valencian SMBs?

We work with all types of companies, from self-employed professionals with a digital presence to IBEX 35 companies. We have offers designed specifically for Valencia's SMBs, with scopes and pricing adapted to their reality.

How much does a cybersecurity service cost for a company in Valencia?

The cost depends on the scope. A basic vulnerability assessment for an SMB starts at €1,500. A full pentest (web + internal network) ranges between €4,000 and €12,000 depending on complexity. Request a free consultation and we'll give you a no-obligation quote within 24 hours.

Can you help us comply with the NIS2 directive from Valencia?

Yes. We advise Valencian companies on NIS2 readiness, identifying whether they're in scope, performing the gap analysis, implementing the required controls and preparing the documentation for the competent authority (INCIBE-CERT / CCN-CERT).

Do you work with industrial and logistics companies in Valencia?

Yes. We have experience with OT/ICS environments, industrial networks and SCADA systems, common across Valencia's industrial base (Paterna Industrial Zone, Port of Valencia, Almussafes industrial parks). Securing industrial environments requires different approaches from conventional IT.

What exactly does an IT security company like QuantumSec do?

An IT security company assesses, protects and monitors your organization's digital systems. At QuantumSec we specialize in the offensive side: penetration testing (simulating real attacks), ethical hacking (auditing your defenses from an attacker's perspective), vulnerability assessment and regulatory compliance (NIS2, ENS, ISO 27001). Unlike a generalist security company, our offensive approach identifies real flaws before third parties exploit them.

When does the Cyber Resilience Act enter into force?

The CRA entered into force on December 10, 2024. The technical and conformity requirements apply in full from December 11, 2027. There are two intermediate milestones: since June 11, 2026, Member States can designate notified bodies for third-party assessment, and since September 11, 2026, actively exploited vulnerabilities and severe incidents must be reported to ENISA.

Does the CRA apply to all software or only to connected hardware?

The CRA applies to all "products with digital elements": hardware and software with direct or indirect network connectivity. Excluded are open-source software released without a commercial purpose, pure SaaS without client-side installable components, medical devices regulated under the MDR, civil aviation products and defense equipment. If your SaaS includes a desktop agent or an installable plugin, that component does fall within the scope of the CRA.

What are the penalties for CRA non-compliance?

The CRA sets three levels of penalty: up to €15 million or 2.5% of global annual turnover for breaching the essential cybersecurity requirements; up to €10 million or 2% for breaching other obligations; and up to €5 million or 1% for providing incorrect information to the authorities.

What is the difference between Class I, Class II and Default products?

Default products are the majority and can use self-assessment. Class I includes higher-risk products (identity management systems, browsers, password managers, security software, home routers) and requires third-party assessment unless a harmonized standard is fully applied. Class II includes the most critical products (server operating systems, hypervisors, industrial firewalls, industrial control systems, PKI, TPMs) and must undergo an audit by a notified body.

Does the CRA overlap with NIS2 or other regulations?

Yes. NIS2 regulates the cybersecurity of essential service operators, while the CRA regulates the security of digital products before they are placed on the market. If you are a software manufacturer and also operate an essential service, both apply to you. There are also overlaps with the MDR for connected medical devices (the MDR prevails) and with the EUCS scheme for critical cloud products.

How long does it take to comply with the CRA?

It depends on your starting point and product category. Companies with a secure SDLC already in place and mature vulnerability management processes can complete the process in 6–9 months. Organizations starting from scratch will need 12–24 months for full compliance before the 2027 deadline.

What's the difference between ethical hacking and pentesting?

Ethical hacking is a comprehensive assessment that combines multiple vectors — OSINT, external perimeter, internal network, privilege escalation — to simulate a full attack campaign against your organization. Penetration testing is a technical test scoped to one specific system or surface: a web app, an API, a network. If you need to assess a specific system, choose penetration testing; if you want to know how far a real attacker would get across your whole organization, choose ethical hacking.

Can ethical hacking affect my production systems?

The scope is defined precisely before starting. By default we avoid actions that could disrupt service (DoS, data deletion). If any test carries a potential risk of impact, we agree on it with you and run it during a maintenance window.

Do I need to sign anything before you start?

Yes. Before any activity we sign a scope agreement and an NDA. This protects both your organization and the audit team and defines exactly what's authorized.

How much does an ethical hacking service cost?

It depends on the scope: type of assessment (external, internal, or both), number of assets and test depth. We offer a free initial call to properly size the project and give you an accurate quote.

Do you work with companies outside Valencia?

Yes. We have clients across Spain. External ethical hacking is carried out fully remotely. Internal assessments may require physical presence or VPN access to the environment depending on the agreed scope.

What happens if you find something critical mid-engagement?

It gets reported immediately, not held back for the report. If a finding allows data to be compromised or operations to be halted, we alert your technical contact through the agreed channel the same day, with the minimum needed for you to contain the risk. The rest of the exercise continues afterwards. Sitting on a critical vulnerability for two weeks so it looks better in the deliverable is not a defensible practice.

What is the difference between external and internal ethical hacking?

The external exercise starts from what an attacker sees from the internet, with no credentials: exposed surface, reachable services and entry points. The internal one starts from a position already inside the network — an employee, a compromised workstation or a supplier — and measures how far privileges can be escalated from there. Plenty of companies have a reasonably closed perimeter and a flat internal network, and only the second exercise reveals it.

What's the difference between your SMB solution and your startup solution?

SMBs usually prioritize protecting the existing business (pentesting, vulnerability assessment, NIS2), while startups usually need to prove their security to investors or enterprise clients (due diligence, SOC2/ISO 27001 compliance, secure SDLC). Although the services overlap, the approach and documentation differ.

Do you work with very small companies, under 10 employees?

Yes. We have experience with microbusinesses and self-employed professionals with specific security needs, especially in regulated sectors like healthcare, legal or fintech. Scope and cost are adapted to your size and your real critical assets.

Can you support us through the entire ISO 27001 certification process?

Yes. We offer end-to-end support: from the initial gap analysis to preparation for the external certification audit. We also follow up during the control implementation phase.

Does SaaS pentesting require access to the source code?

Not necessarily. Black-box or gray-box testing (without code access) already detects most critical SaaS vulnerabilities. If you give us access to the source code (white-box testing), we combine the penetration test with static analysis (SAST) for greater coverage.

Can we run the pentest against the staging environment?

Yes. It is the most common option in SaaS: you prepare a staging environment with representative data (not real customer data) and we run the pentest there. The key is that the environment faithfully mirrors production in configuration, infrastructure and business logic.

Does SaaS pentesting also cover the cloud infrastructure?

It can be included as additional scope. A SaaS application pentest covers the application layer (web, API, logic). If you also need to review IAM configuration, security groups, S3 policies or Kubernetes, we add it as a cloud pentesting component.

How long does a SaaS application pentest take?

Between 5 and 10 business days for applications of medium complexity. The duration depends on the number of endpoints, user roles, integrations and the agreed depth. For SaaS with a microservices architecture it can take longer.

Is the report suitable for presenting to enterprise customers or investors?

Yes. The executive report is designed to be presented to management, enterprise customers and in investment due diligence processes. It includes a summary of the scope, methodology, findings and remediation status.

Can you integrate with our current bug bounty platform (HackerOne, Bugcrowd, Intigriti)?

Yes. We work on the client's existing platforms without needing to switch tools. We also integrate with in-house channels: web forms, secured email, Jira, GitHub Issues or any ticketing system. The client keeps full visibility into the entire process.

What's the SLA for responding to a critical report?

For reports classified as critical, the maximum first-response time is 8 hours on business days and 24 hours on weekends. For high-severity reports, the SLA is 24 hours on business days. These parameters are configurable to fit your program's needs.

What happens if we disagree with your assessment of a report?

The client always has the final word. If there's disagreement over a report's assessment, we review it together, provide the technical evidence supporting our position and agree on the final classification. It's a collaborative service, not a black box.

How do you guarantee the confidentiality of reports?

We sign a specific NDA for the triage service before starting. All reports and their contents are strictly confidential. Access to reports is restricted to the technical team assigned to the client. We never share information about a client's vulnerabilities with third parties.

Can you validate vulnerabilities without access to production?

It depends on the vulnerability type. For many findings (XSS, CSRF, business logic, authorization flaws) we can validate with test credentials in a staging environment. For others that require observing production behavior, we agree a safe validation window and procedure with you.

Why CVSS 4.0 and EPSS rather than just the researcher's severity?

The severity a researcher proposes is a hypothesis. CVSS 4.0, published by FIRST in 2023, measures technical severity with more granular metrics than 3.1 and can be adjusted for your environment; EPSS estimates the probability of exploitation in the next 30 days. Combined with the impact we confirm by reproducing the attack, they give a priority you can defend to development and management. If your program already uses CVSS 3.1, we work with both versions in parallel.

How much does external triage cost?

The cost depends on the estimated monthly report volume, the required SLA level and whether the service includes researcher communication. We work with fixed monthly rate models based on report volume. It's significantly cheaper than hiring an in-house triage analyst, and much more flexible.

How is this different from hiring HackerOne or Bugcrowd?

HackerOne and Bugcrowd are platforms: they give you access to a community of researchers and management tools, but you still need an in-house team to triage and validate. We're the external team that does that work. We can operate on the platforms you already use, or design a program independent of them.

Can you manage programs already active on another platform?

Yes. We work on HackerOne, Bugcrowd, Intigriti and any in-house channel. There's no need to change platform or process. We simply add the triage and management layer you're missing.

How long does it take for the service to be up and running?

Standard onboarding takes between 5 and 10 business days: technical briefing, access and integration setup, and workflow definition. For more complex programs or multiple integrations, it can take longer.

How much reward budget do we need to start?

It depends on scope and on the severity you accept, but the most common mistake is not under-budgeting: it is opening the program with no published reward table. Without one, every report becomes a negotiation, response times stretch and good researchers stop submitting. Set the table before opening, publish it, and revise it with data from your own program after six months.

What if we receive more reports than we can handle?

That is the usual scenario in the first weeks of a public program, which is why starting private with a limited group of researchers is recommended. External triage absorbs the volume: it validates, discards duplicates and out-of-scope submissions, and only confirmed findings with demonstrated impact reach your team. If the bottleneck is remediation rather than triage, the program is expanded in phases instead of opened all at once.

Does a bug bounty replace penetration testing?

No, they cover different things. A pentest is bounded in scope and time, with guaranteed coverage of what was agreed and a deliverable report that works in front of a client or an auditor. A bug bounty is continuous and offers no guaranteed coverage: nobody assures you anyone will look at your least attractive module. The sensible combination is pentesting for coverage and evidence, and bug bounty for ongoing monitoring between engagements.

What do I need to tell researchers about who manages the program?

You decide the level of transparency. We can operate on your behalf without researchers knowing there's an external provider, or we can mention that triage is handled by a specialized external security team. Both models are valid and common in the market.

Can you manage private bug bounty programs?

Yes. We manage both public programs (open to any researcher) and private ones (invited researchers only). Private programs have different dynamics and require more active researcher community management, which we also cover.

What happens with duplicate or out-of-scope reports?

We close them ourselves with a reasoned reply to the researcher, without them ever reaching your team. A duplicate is linked to the original report and an out-of-scope submission is explained by citing the program's published rules. This is the least rewarding part of running a bug bounty and the one that damages most relationships when handled with curt templates: a badly answered researcher stops reporting, and tells others.

Who decides how much each report is paid?

You do. We propose the bounty by applying the reward table agreed at the outset, based on severity and demonstrated real impact, and you approve it. What we do recommend is setting that table before opening the program and publishing it: negotiating every reward case by case creates disputes, stretches response times and eventually drives away the good researchers.

Does NIS2 require me to have a VDP?

NIS2 requires essential and important entities to have mechanisms to manage and report vulnerabilities, which includes having a vulnerability notification channel. Although the directive doesn't explicitly use the term VDP, the most common way to meet this requirement is to implement a Vulnerability Disclosure Program. We help you assess exactly what your company needs.

How long does it take for the VDP to be operational?

Standard design and implementation of a VDP takes between 2 and 4 weeks: policy drafting, channel setup, testing and publication. If you need to accelerate it for an audit or compliance process, we can adjust the timeline.

What happens if we receive a critical vulnerability?

Critical reports have an immediate escalation channel. As soon as we identify a report with potential critical impact, we escalate it directly to the client's security lead — regardless of the time of day — and coordinate the emergency response. The SLA for critical reports is 4 hours on business days.

Can you help coordinate the public disclosure of a vulnerability?

Yes. If a researcher wants to publish their finding (CVE, blog post, conference talk), we manage the coordinated vulnerability disclosure (CVD) process following the ISO 29147 standard: we agree on the disclosure timeline, coordinate with the researcher and prepare the necessary communications.

How does a CMS security audit differ from web maintenance?

Web maintenance updates versions and takes backups. A CMS security audit simulates real attacks to find vulnerabilities that updates do not fix: vulnerable application logic, misconfigurations, extensions with insecure code or CMS-specific vectors that automated scanners do not detect.

Does the pentest disrupt the website's operation?

We coordinate the scope to minimize operational impact. In most cases we work on a staging environment or during low-traffic windows. If production is unavoidable, we schedule the most invasive tests outside business hours.

Does the CMS pentest also cover hosting and the CDN?

Yes, within the agreed scope. We review the web server configuration, HTTP security headers, access to sensitive paths, file permissions and, where applicable, the WAF and CDN configuration (Cloudflare, Fastly). The hosting environment is part of the CMS attack surface.

Do you also do the remediation or just the report?

We deliver the analysis, the evidence and the remediation plan. The fixes are carried out by your team or your web agency following our instructions. We always include support during the remediation phase and an optional retest to verify that the findings have been resolved.

Is the report valid for compliance audits (ENS, ISO 27001, PCI-DSS)?

Yes. The report follows recognized methodologies (OWASP, PTES) and is valid as pentesting evidence for ISO 27001 certification, ENS conformity or PCI-DSS compliance processes. We indicate the coverage against the applicable security controls.

Do you need admin access to our Workspace?

For the configuration review, a read-only admin role or a delegated role with audit permissions is enough. For offensive testing we agree on the scope in advance and, if needed, a test account. Everything is done with explicit authorization and under a confidentiality agreement (NDA).

Does the audit disrupt employees' work?

No. Most of it is configuration and attack-surface analysis, which doesn't affect users. The few active tests are agreed and run in a controlled way so they don't impact operations.

How is this different from the recommendations Google already shows?

Google's panels flag recommended settings, but they don't think like an attacker or chain vectors together. We look for the real compromise path: a forgotten OAuth app, a dangerous domain-wide delegation or a forwarding rule that keeps access even after a password change.

Do you also audit Microsoft 365?

Yes. We apply the same offensive methodology to Microsoft 365 (Entra ID, Exchange Online, SharePoint). If you use both, we audit both environments and their integration points.

Is the report valid for compliance (ENS, ISO 27001, NIS2)?

Yes. The report documents the security posture of your email and collaboration environment against recognized frameworks (CIS Benchmark) and is valid as evidence for ENS conformity, ISO 27001 certification or NIS2 compliance.

Do you need admin access to our tenant?

For the configuration review, a read-only role (Global Reader) or a delegated role with audit permissions is enough. For offensive testing we agree on the scope in advance and, if needed, a test account. Everything is done with explicit authorization and under a confidentiality agreement (NDA).

How is this different from Microsoft's Secure Score?

Secure Score flags recommended settings, but it doesn't think like an attacker or chain vectors together. We look for the real compromise path: an app with illicit consent, a gap in conditional access or a forwarding rule that keeps access even after a password change.

Do you also audit Google Workspace?

Yes. We apply the same offensive methodology to Google Workspace. If you use both, we audit both environments and their integration points.

How exactly does a Red Team differ from an Active Directory pentest?

An Active Directory pentest analyzes the AD environment in depth within a known technical scope, looking for the maximum number of configuration and privilege escalation flaws. A Red Team starts from outside the perimeter, with a concrete business objective, without the defensive team knowing, and only touches AD if that's the most realistic path to the objective — it's a test of the whole organization, not of the AD environment itself.

Is this the same as the TLPT DORA requires?

TLPT is a Red Team run under the TIBER-EU regulatory framework, with specifically accredited providers and coordination with the supervisor, mandatory for financial entities designated as critical. Our standard Red Team follows the same methodological logic and is the ideal preparation before a formal TLPT; for the regulatory TLPT itself, we advise you on the required accreditation process.

What happens if the defensive team catches us on day one?

That's a valid and valuable outcome — it means your defenses work for that vector. In that case, with your consent, we can adjust the exercise to keep testing other vectors or more advanced evasion techniques, maximizing what you learn from the exercise.

Does it include in-person social engineering and physical access?

Only if explicitly agreed in scope. It's not a default component: some organizations include it (tailgating, USB devices, impersonating technical staff) and others prefer to limit it to digital vectors. It's defined during the rules-of-engagement phase.

How is this different from a phishing simulation (social engineering)?

A phishing simulation tests a single vector — the human one — in isolation, with a scope known in advance by whoever commissions it. A Red Team may use phishing as one of several entry vectors, but only if it serves the defined business objective, combined with technical exploitation and lateral movement; it isn't an end in itself and isn't measured independently.

Is this the same as a segregation of duties (SoD) review for internal audit?

No. An SoD review for internal audit or compliance confirms a documented matrix exists and that, on paper, no prohibited combinations are assigned. Our audit goes further: it confirms which of it is actually exploitable, adds analysis of the RFC/Gateway interface, custom ABAP code and patch status, and simulates the real impact of an attacker, not just the documented theoretical risk.

Do you need access to the production system?

For the configuration and authorization review, a read-only user or access to a pre-production system with the same configuration is enough. For active offensive testing we agree in advance on the scope, the environment (usually pre-production) and, if needed, a test account. Everything is done with explicit authorization and under a confidentiality agreement (NDA).

Do you cover both on-premise SAP and S/4HANA Cloud?

Yes, adapting the scope: on-premise and S/4HANA Private Cloud analysis includes the infrastructure layer, the Gateway and the underlying operating system; S/4HANA Public Cloud scope focuses on authorizations, integrations and configuration, since SAP directly manages part of the infrastructure.

Does the audit disrupt ERP operations?

No. Most of the work is configuration, role and code analysis, which doesn't affect users. Active tests are agreed in advance, preferably run in a pre-production environment, and if they must touch production, within a window agreed with the Basis team.

Is the report valid for regulatory compliance (NIS2, ENS, ISO 27001)?

Yes. The report documents the security posture of the SAP environment with evidence and is valid as part of the documentation for NIS2 compliance, ISO 27001 certification or conformity with Spain's National Security Framework (ENS) for the systems within its scope.

Who does the AI Act apply to?

It applies to providers who develop AI systems, to deployers who use them within their organization, and to importers and distributors, inside and outside the EU if the system is used in European territory. It applies regardless of company size.

I'm self-employed and use third-party AI tools. Do I have obligations?

Yes, as a deployer you have obligations even if you didn't build the system: informing affected people where required, human oversight for high-risk systems, and not using prohibited AI practices such as social scoring.

How much time do I have to comply?

The timeline is progressive: prohibited AI practices have already been illegal since February 2025; governance and general-purpose model obligations apply from August 2025; Annex III high-risk system obligations apply from August 2026.

What penalties does the AI Act impose?

Up to €35M or 7% of global annual turnover for prohibited AI practices; up to €15M or 3% for other regulatory breaches; up to €7.5M or 1% for providing incorrect information to authorities.

Does the AI Act replace GDPR?

No, they're complementary. The AI Act specifically regulates AI systems and their risk level; GDPR still applies to any personal data processing that system performs.

How do I know which risk level my AI system falls into?

By its use, not by its technology. The AI Act classifies according to what the system is used for: there are prohibited practices, high-risk systems listed in Annex III — biometrics, employment, credit, education, essential services — systems with transparency obligations such as chatbots and content generators, and everything else at minimal risk. The same model can fall into two different levels depending on purpose, so classification is done per use case.

How does the AI Act relate to the security of my AI systems?

For high-risk systems, Article 15 requires an appropriate level of accuracy, robustness and cybersecurity, including resilience against attempts to alter their use or behavior by exploiting vulnerabilities. That translates into concrete testing: prompt injection, data poisoning, model evasion and information extraction. It is exactly the scope of an AI systems penetration test, and evidence of having run it forms part of the technical documentation the regulation requires.

Does this replace the general Microsoft 365 audit?

Not necessarily. If email is your most critical system or you've already had an email-related incident, it makes sense as a standalone engagement. If you want a full tenant review (Entra ID, SharePoint, Teams, OAuth apps), the Microsoft 365 audit is the better fit.

Do you need global admin access?

No. A read-only role over Exchange Online (for example, Exchange Recipient Administrator) is enough for most of the analysis.

Does it disrupt mail flow?

No. The analysis covers configuration and permissions, and doesn't affect production mail flow.

Can you detect an ongoing compromise?

Analyzing forwarding rules and delegated permissions can reveal the persistence of an attacker who has already compromised an account, though this isn't an incident response service.

Is the report valid for regulatory compliance?

Yes. The report is valid as technical control evidence for corporate email security under NIS2, ENS or ISO 27001.

How is this different from Secure Score or Microsoft Defender alerts?

Secure Score rates recommended settings and Defender alerts on suspicious activity, but neither reviews mailbox by mailbox who holds delegated permissions, which forwarding rules exist or whether a connector lets someone send mail spoofing your domain. We check what an attacker could do with a compromised mailbox, not just which boxes are unticked.

What if we still run Exchange Server on-premise or a hybrid setup?

The audit focuses on Exchange Online. In a hybrid setup we also review the connectors and hybrid configuration on the Microsoft 365 side, which is where unfiltered mail usually slips through. The Internet exposure of an on-premise Exchange Server (OWA, ECP, patch level) is better covered by an external network and infrastructure penetration test.

Does this make me compliant with the AI Act?

It is the operational prerequisite for it, not full legal compliance. Without knowing which AI systems your organization uses and for what, you cannot classify them by risk level or demonstrate human oversight to anyone. This service gives you that inventory and that control. Formal compliance with the regulation — classification, provider or deployer role, technical documentation — is our AI Act consulting service, and it builds on the work done here.

How long does it take and what does it ask of my team?

The assessment and the policy take around three weeks for a mid-sized organization. The load on your team is concentrated in discovery: read-only access to review connected applications, and a few minutes from each person for the anonymous survey. Training runs as sessions of 45 to 90 minutes depending on the audience.

Are you going to ban the tools we already use?

That is not the goal. In most cases the outcome is the opposite: the tools already in use get formally approved, their retention and training settings get corrected, and only the type of data that must not go in is restricted. Banning without an alternative pushes usage to personal phones and makes visibility worse.

Does it work for a small company with no IT team?

Yes, and it is usually faster. In a small organization the inventory can be completed within days and the policy fits on one page. What does not change with size is the risk: pasting a client contract into a public chatbot has the same impact in an eight-person company as in an eight-hundred-person one.

How is this different from auditing the security of our own AI system?

They are different things. This service governs your team's use of third-party AI tools. If what you have is your own product with a model, a customer-facing chatbot or a RAG pipeline, what you need is AI penetration testing, which attacks that system to find its vulnerabilities. Many companies end up needing both, but they solve different problems.

How much does it cost to train a team in cybersecurity?

It depends on the program and number of sessions. An employee awareness session, online and around 90 minutes, starts from a fixed price per group. A technical program with several sessions and hands-on work on your own code, or a leadership session, is quoted per project or per session. We give a fixed price before starting, and the first scoping call is free.

Does the training count as evidence for NIS2, DORA or the ENS?

Yes, and it is one of the most common reasons companies commission it. NIS2 requires cybersecurity training for management bodies in Article 20, DORA requires something equivalent for financial entities, and the ENS includes staff awareness and training among its measures. We deliver attendance records, contents covered and evaluation in the format an auditor expects, which is what actually gets asked for in the review.

Can you train our team on the use of artificial intelligence?

Yes, it is its own program with three tracks —leadership, technical teams and staff— and labs on 0data, our private AI platform: what may be pasted into ChatGPT, Copilot or other assistants, how an AI application is attacked and how it is controlled. The training can be booked on its own. If you also need to discover which AI tools your team is actually using and draft a usage policy, that is a broader project we offer through the safe AI use service.

Is the training on-site or online?

It depends on the program. Awareness and leadership sessions work well remotely and allow larger groups. Technical team sessions and regulatory workshops perform better on-site, because they include hands-on work and group discussion. We are based in Valencia and travel across Spain depending on the project.

Does this report work if the tender doesn't require ENS or ISO 27001?

Yes, that's exactly the case this service covers. Many tenders ask for a cybersecurity audit report — pentest and GDPR review — without requiring formal certification. If your tender does require ENS or ISO 27001, you need that certification process: see our ENS audit and compliance service.

How long does the report take?

Between 5 and 10 business days from kickoff, depending on the system's complexity and the number of integrations to review. If the tender deadline is shorter, tell us during the scoping call: we prioritize projects with a known hard deadline.

Can we start before the tender is resolved?

Yes, and we recommend it. If you agree on a provider and scope in advance, the report can be ready before the award, and you only need to submit it when the documentation deadline opens.

What if the tender requires ENS, ISO 27001 or a specific INCIBE certificate?

This service doesn't replace formal certification. If the tender requires ENS or ISO 27001 you need that process with an accredited body; we can help with the prior compliance phase. See ENS compliance or ISO 27001 compliance depending on what your tender asks for.

Does it cover third-party systems like payment gateways or IoT devices connected to the platform?

Yes, as long as they're part of the tendered system. We don't audit the payment provider's or device manufacturer's infrastructure directly, but we do review how it integrates with your platform and what data is exchanged.

Can this report be submitted by a company acting as the local partner of a foreign vendor?

Yes. It's a common case: a foreign software company partners with a Spanish bidder, and the report covers the tendered technical system regardless of where the company that built it is based.

Does this replace having a Data Protection Officer (DPO)?

Not necessarily. If your company is required to have a DPO, this audit is complementary: it assesses the real state of compliance, and the DPO can use the report to prioritize their work. If you don't have a DPO, the audit gives you an independent snapshot without needing to hire that role permanently.

Do I need this audit if a lawyer already wrote my website's privacy policy?

The privacy policy is the user-facing document; it doesn't prove that internal processing, vendor contracts or technical measures are actually in order. It's common to find companies with a flawless privacy policy and no real Record of Processing Activities behind it.

How long does the process take?

Between 2 and 4 weeks for a mid-sized company, depending on the number of processing activities and vendors to review. For a scope narrowed to a single product or system it can be faster.

Is the report valid for submission in a public tender?

Yes, if the tender asks for a GDPR compliance review as part of the accreditation documentation. If it also requires a penetration test of the tendered system, see our public tenders audit service, which combines both in a single report on express timelines.

Do you also audit third-party vendor compliance (cloud, third-party SaaS)?

We review the contracts and DPAs you have signed with them and how data flows to those vendors, but we don't audit the vendor's internal infrastructure unless it's part of a separately contracted pentest.

What happens if you find a serious non-compliance issue?

We classify it by real risk, not just formal risk, and give you a prioritized roadmap. How and when to remediate it is your call; we can support the implementation if you need it.

What is the difference between TLPT and a penetration test?

A penetration test looks for vulnerabilities within a defined scope, usually with the defensive team informed. TLPT starts from real threat intelligence about your entity, runs in production against critical functions and keeps the defensive team unaware, because what it measures is detection and response capability, not just the presence of flaws.

Do all financial entities have to run TLPT?

No. DORA requires a resilience testing program of every entity in scope, but advanced testing such as TLPT applies to those designated by their competent authority based on criteria including size, risk profile and relevance. If your entity is not designated, the rest of the testing program still applies.

How often must a TLPT be repeated?

DORA sets a minimum frequency of three years for entities in scope, without prejudice to what the competent authority determines. It is worth planning ahead: the full cycle, including prior intelligence and subsequent remediation, runs over several months.

What is TIBER-ES and who oversees it in Spain?

TIBER-ES is the Spanish implementation of TIBER-EU, coordinated by the Bank of Spain together with the CNMV and the DGSFP depending on the type of entity. It is the framework under which the threat intelligence-led advanced testing required by DORA is carried out in Spain, and documenting the exercise in line with it is what makes it easier for the supervisor to recognize.

How does TLPT relate to TIBER-EU?

TIBER-EU is the European Central Bank framework for threat intelligence-led testing and is the methodological reference underpinning DORA TLPT. Documenting the exercise in line with TIBER-EU makes it easier to submit to the supervisor.

Can the team that runs our regular audits also run the TLPT?

DORA requires providers of advanced testing to demonstrate independence, reputation and technical capability. It is worth reviewing potential conflicts with whoever already delivers recurring services to the entity before awarding the exercise.

How long does a full TLPT take?

It depends on scope, but a TLPT covering intelligence, execution, closing and remediation rarely takes less than three months. Entities that leave it until the deadline is looming end up cutting scope, which is precisely what the supervisor examines.

How much does the session cost?

A 2-3 hour session for the board or management committee, on-site or online, starts from a fixed price per session. It is adjusted by number of attendees and whether it includes extra executive summary material. The first scoping call is free.

Does this count as evidence for NIS2 or DORA?

Yes. NIS2 requires cybersecurity risk management training for management bodies under Article 20, and DORA requires something equivalent for the management body of financial entities. We deliver an attendance record and contents in the format an auditor expects to find in the review.

Is this the same as a regulatory compliance gap analysis?

No. A NIS2 or DORA gap analysis assesses whether your controls meet the regulation; this session trains the management body to understand the risk and their accountability. They are complementary services: training usually fits well at the start of a compliance project or right before an audit.

Can the technical team also attend?

The session is built for leadership, but it can be opened to middle management if the goal is to get everyone aligned before budget decisions. If what you need is in-depth training for the technical team, that is a different session — see our technical training.

How much does technical training cost?

A secure coding program with several sessions and hands-on work on your own code is quoted per project, based on number of sessions and team size. We give a fixed price before starting, and the first scoping call is free.

Do you need access to our code to prepare the training?

It is not required, but it improves the result significantly. If you have already done a pentest or code audit with us, we already have the findings; otherwise we work with anonymized snippets you provide or with examples in the same language and framework you use.

Is this the same as a source code audit?

No. A code audit finds and reports concrete vulnerabilities in your product; this training teaches the team not to make them in the future, often using the findings of a previous audit as teaching material. The usual sequence is to audit first, then train on what was found.

Do you also train teams in detection, not just secure development?

Yes, it is a separate program within this same technical training: we teach defense teams what traces an attacker leaves in logs, network traffic and endpoint behavior, based on the techniques we use ourselves in pentesting and red team engagements.

How much does an awareness session cost?

A roughly 90-minute online session starts from a fixed price per group, with a volume discount for several sessions across departments. We give a fixed price before starting, and the first scoping call is free.

Do you run phishing simulations as part of this training?

Phishing simulation is a separate service: it is an offensive exercise that measures real behavior, not a class. The two complement each other well — the usual sequence is to simulate first to find where the problem is, then train on the results — but they are booked separately. If what you want is to measure, start with phishing simulations.

Does this count as evidence for the ENS?

Yes. The ENS includes staff awareness and training among its measures (op.per.4), and it is one of the most common reasons companies book this session. We deliver attendance records, contents covered and evaluation in the format an auditor expects to find in the review.

Is the session on-site or online?

Both work well for awareness training; online allows larger groups and several short sessions instead of a single day. We are based in Valencia and travel across Spain if the project requires it.

Do I need to buy 0data to take the training?

No. The training is booked on its own and works just as well if you use ChatGPT, Copilot or Gemini. 0data is the lab environment because it lets you see the risks and the controls really working. If it fits afterwards, the way to start is a six-week pilot at a fixed price.

Do the labs use our data?

They don't need to. By default we work with synthetic data in our 0data lab. If you already have 0data installed or want to try it in-house, the labs run on your installation and the data never leaves your infrastructure.

Is this the same as the safe AI use service?

No. The safe AI use service is the full governance project: discovering which tools the team actually uses (shadow AI), drafting the usage policy and training on it. This page is just the training, by track, and can be booked without the rest.

How much does it cost?

A fixed price per session or workshop, depending on the track, the number of attendees and whether it is on-site or online. We give it to you after a first scoping call, which is free.

Do we need to already have an AI usage policy?

It is not required. If one exists, the training builds on it; if not, we give the basic rules — what never gets pasted, which tools are approved — without waiting for the document to be drafted.

How is it different from the training for technical teams or for leadership?

Those programs cover cybersecurity in general: secure development and defense, or board risk and liability. This one focuses only on AI: how to use it, how to attack it and how to control it, with labs on a real platform.

Is this the same as the regulatory compliance service?

No, they are complementary. The compliance service runs the gap analysis, drafts the documentation and supports the full project end to end. The workshop is a one-off working session: it builds on that gap analysis, or on the regulation if you don't have one, and leaves the team with an assigned plan. Many clients book the workshop as a starting point before deciding whether they need the full project.

Is this the same as the leadership session?

No. The leadership and board session is a 2-3 hour talk on risk and legal accountability, built for those who decide the budget. The regulatory workshop is a longer, more technical working session, built for those who have to implement the controls day to day.

How long does it take and how much does it cost?

Usually half a day or a full day, depending on how many articles or controls are worked through. It is quoted per session, with a fixed price before starting. The first scoping call is free.

Can you cover several regulations in the same workshop?

Yes. When they share controls — NIS2, DORA and ISO 27001 overlap significantly in risk and incident management — working on them together in the same workshop saves time compared to repeating the session for each regulation.

Does Spain's NIS2 law apply to us if the group already complies with NIS2 in another EU country?

As a general rule, yes: NIS2 applies in the Member State where the entity is established, so a Spanish subsidiary answers to Spanish rules and authorities even if headquarters complies elsewhere. There are exceptions: DNS, cloud, data center, content delivery network, managed service and managed security service providers, as well as certain digital platforms, fall under the Member State of their main establishment in the EU. We assess this case by case in the applicability map.

Where does Spain's NIS2 transposition law stand?

The Council of Ministers approved the draft Law on the Coordination and Governance of Cybersecurity in January 2025, but as of October 2026 it has not been published in the BOE, and the European Commission referred Spain to the Court of Justice of the EU in July 2026. In the meantime, Royal Decree-Law 12/2018 remains in force. Obligations and penalties are covered in detail on our NIS2 consulting page.

Do we need ENS certification if we are only a supplier to a Spanish public body?

If you provide services or solutions to a Spanish public-sector entity, Royal Decree 311/2022 extends to your systems and tender documents usually require conformity. For MEDIUM or HIGH category systems, conformity is demonstrated through a certification audit by an accredited certification body (in Spain, accredited by ENAC); for BASIC category, a self-assessment is enough. A group-level ISO 27001 certification helps, but it does not replace the ENS.

Is our data protection authority the AEPD or the one in our headquarters country?

It depends on where the group's main establishment in the EU is. If it is in another Member State, that country's authority can act as lead supervisory authority for cross-border processing (the GDPR one-stop shop), but the AEPD remains competent for local matters and the LOPDGDD adds Spain-specific requirements. If the group has no main establishment in the EU, there is no one-stop shop and the Spanish subsidiary deals directly with the AEPD.

How does DORA work if our ICT services come from headquarters?

DORA has applied directly to EU financial entities since January 17, 2025, with no transposition law. ICT services provided by another company in the same group also fall under the regulation's ICT third-party risk management, so the group's service center must appear in the register of information and in the contracts. In Spain, supervision sits with the Banco de España, the CNMV or the DGSFP depending on the type of entity.

Do you work in English?

Yes. Meetings, technical reports and executive summaries can be in English for the group's security team, and the documentation submitted in Spain (tenders, auditors, authorities) is delivered in Spanish. That way the same work serves both headquarters and the subsidiary with no translation afterward.

Can we engage you for just one piece, such as the pentest or the ENS?

Yes. The service is designed so one provider can cover several frameworks, but each piece can be contracted separately. If you already know you only need the ENS or NIS2, it's quicker to start with those pages or with the ENS scoping form.

What commission or discount does the program offer?

There is no single rate card. Commercial terms are tailored to the model (referral, white-label or co-selling), the type of projects and the expected volume, and they are put in writing in the partnership agreement before the first project.

Who owns the client relationship?

It's agreed in writing for each model. In white-label, the relationship is yours and we don't contact the end client on our own. In referral and co-selling, each party keeps its own part. What matters is that it's defined before starting, not halfway through a project.

What if our end client contacts you directly afterwards?

It's one of the things written into the partnership agreement, precisely so nobody has to improvise. In white-label, any new request from the end client is channeled through you as agreed.

Can reports carry our brand?

Yes, under the white-label model, when the project allows it. In some cases the end client or a third party (an insurer, an auditor, a tender) requires the report to state who performed the testing; if so, we flag it in the proposal.

How long does it take to get a proposal for a client?

With a clear scope, the proposal with scope, methodology, timeline and price arrives within 24-48 hours of the scoping call. You can use our interactive scoping forms to collect the details with your client.

What are the requirements to join the program?

We cover that in the first conversation: what clients you have, what they ask for and which model fits. There's no fixed sign-up form; the terms, including any commitments on either side, are tailored in the partnership agreement.

What if the pentest finds flaws in something we maintain?

It's common when the partner is the client's agency or MSP, and it's exactly the value of an independent review. How it's communicated is agreed from the start: usually your team learns about the findings in time to fix them, and the retest documents that they were resolved.

How is our clients' information protected?

We sign an NDA before receiving any information, work only within the scope the end client has authorized in writing and, if the project involves processing personal data, put the corresponding GDPR data processing agreement in place.

Can a broker use the report for cyber insurance underwriting?

A penetration test report documents what was tested, what was found and what was fixed, which is the technical evidence underwriting questionnaires usually ask for. If the insurer asks for something specific, the scope is adjusted in the proposal. The underwriting decision always rests with the insurer.

What if the client needs something you don't do?

We specialize in offensive security and compliance; we don't do web development, day-to-day systems administration or insurance brokerage. The program is designed to complement what you already offer, not replace it: each party covers its own part.

What is cyber insurance?

It is a policy that covers the financial consequences of a cyberattack or a data breach: the company's own losses and its liability to third parties. Cyber insurance, cyber risk insurance and cybersecurity insurance are different names for the same kind of product. It does not prevent the attack: it complements security measures, it does not replace them.

What does cyber insurance cover?

It depends on the policy, but it usually groups three blocks. First-party losses: incident response and forensics, data and system recovery, business interruption, crisis management and notification of affected people, and in some policies ransomware extortion. Third-party liability: claims from clients or employees over their data and legal defence, sometimes including defence in data protection penalty proceedings. And fraud: CEO fraud or supplier impersonation, often with its own sublimit or as an extension.

What does it usually not cover?

Exclusions vary, but the most common are incidents prior to the policy or already known when buying it, deliberate damage, attacks attributed to a state or in a war context depending on each wording, system upgrades after the incident, and claims where a declared control was not in place. It is worth reading the exclusions before the cover.

How much does cyber insurance cost?

Rates published by insurers and brokers in Spain range from a few hundred euros a year for sole traders and micro-businesses to several thousand for a mid-sized SMB, and go much higher for large companies or regulated sectors. The real figure comes out of the questionnaire: turnover, sector, volume of personal data, limit of indemnity, deductible, claims history and, above all, the security controls you can prove.

What do insurers require before issuing a policy?

Questionnaires repeat themselves a lot: MFA on email, remote access and admin accounts; isolated or immutable backups with tested restores; EDR on endpoints; patching critical vulnerabilities within short timeframes; no remote desktop exposed to the Internet; phishing training and an incident response plan. Without MFA, many insurers will not even quote.

Is cyber insurance mandatory in Spain?

There is no general legal obligation. Neither NIS2, DORA nor the GDPR require you to buy it. In practice it can be mandatory by contract: more and more large clients, public tenders and critical service providers ask their suppliers for it as a condition.

Which is the best cyber insurance for my company?

There is no best one in the abstract: it depends on your risk. When comparing offers, price and total limit matter less than the sublimits (ransomware, fraud, business interruption), the deductible, the waiting period before business interruption pays out, the 24/7 response service and its provider panel, retroactive cover and the exclusions. The comparison and the policy recommendation are made by the broker; we help you arrive with your technical position clear so that comparison is real.

Does insurance pay a ransomware ransom?

Some policies cover extortion, usually with a sublimit and with the insurer’s prior approval. It cannot be paid to people or groups on EU sanctions lists, and in most cases the preferred route is to recover from clean backups. That is why insurers care so much about backups being isolated and restores being tested.

What happens if I declare a control I don't have?

The questionnaire is the basis of the contract. Under Article 10 of the Spanish Insurance Contract Act, if the declaration was inaccurate and a claim arrives before it is corrected, the payout is reduced in proportion to the premium that would have been charged knowing the real risk, and in case of fraud or gross negligence the insurer is released from paying. That is why each answer should be verified before signing.

Do you sell the insurance?

No. QuantumSec is neither an insurer nor an insurance intermediary: we do not sell policies, collect premiums or recommend a specific insurance product. We put you in touch with specialist brokers and insurers we work with, and the purchase and the advice on the policy come from them. Our job is the technical side: making sure what you declare is true and that your company meets what the insurance requires.

Does a pentest or vulnerability assessment lower the premium?

It can improve the terms, because it turns a declaration into evidence and reduces the risk the insurer perceives, but the premium decision is always theirs. What it does guarantee is that what you declare holds up: it is the best insurance for the insurance itself.

What should I do if I suffer a cyberattack and have a policy?

Call the policy's assistance line first, before hiring anyone on your own: many policies work with a provider panel and will not cover an outside provider's costs without authorisation. Isolate the machines without wiping or reinstalling them, keep the logs, file the claim within the policy deadline and, if personal data is affected, remember the notification to the data protection authority is due within 72 hours.