Offensive security services
Certified ethical hackers and manual testing: clear findings, validated and prioritised, ready to act on from day one.
Pentesting
Not sure which of the nine you need? Start with what each one tests.
- Web Pentesting WEB APPLICATION PENETRATION TESTING Manual web application and API pentesting by specialists. Business-logic flaws, broken authorisation and chained exploits, proven and retested. View service
- API Pentesting API PENETRATION TESTING Manual API pentesting for REST, GraphQL, gRPC and SOAP. We test the authorisation and business logic scanners miss. OWASP API Top 10 aligned. View service
- AI Pentesting AI PENETRATION TESTING Expert AI pentesting for LLM apps, RAG pipelines and agent platforms. Prompt injection, tool abuse, cross-tenant paths, retest included. View service
- Cloud Pentesting CLOUD PENETRATION TESTING Manual cloud pentesting for AWS, Azure and GCP. We chain the misconfigurations a CSPM only lists into a proven path to your data. Retest included. View service
- Wireless Pentesting WIRELESS PENETRATION TESTING Manual Wi-Fi penetration testing: Evil Twin, 802.1X, RADIUS and segmentation. We test from the car park and prove what reaches your network. View service
- Internal Pentesting INTERNAL PENETRATION TESTING Internal penetration testing from an assumed breach. We prove how far an attacker reaches inside: Active Directory, backups, Domain Admin. View service
- External Pentesting EXTERNAL PENETRATION TESTING External penetration testing by specialists. We chain OSINT, exposed services and edge CVEs to prove what leads to a foothold inside. View service
- Mobile Pentesting MOBILE APPLICATION PENETRATION TESTING Manual iOS and Android app pentesting, plus the APIs behind them. OWASP MASVS-aligned, proven by hand, retest included. View service
- IoT Pentesting IoT PENETRATION TESTING Manual IoT pentesting across hardware, firmware, radio, app and cloud. We prove how one device on a desk reaches your whole fleet. View service
Other services
- Hire an ethical hacker: ethical hacking service Hiring a hacker is legal when it is an ethical hacker and there is written permission. Manual penetration testing, proof of every finding, a retest. View service
- Red Team RED TEAM Threat-led red team engagements that measure whether you detect and stop a real attacker. Built on the TIBER-EU method and mapped to MITRE ATT&CK. Barcelona. View service
- Dark Web Monitoring DARK WEB MONITORING & BRAND PROTECTION Continuous dark web monitoring for leaked credentials, stolen data and brand impersonation. Verified alerts, takedown and closure. View service
- Phishing Simulation PHISHING SIMULATION Controlled phishing simulations that measure who clicks, train at the moment of the mistake and reduce human risk. Email, smishing, vishing. View service
- Microsoft 365 Hardening MICROSOFT 365 HARDENING Harden your Microsoft 365 tenant against real attacks across identity, email, devices and data. Benchmarked to CIS and CISA SCuBA. Barcelona. View service
- Cybersecurity Training CYBERSECURITY TRAINING: PRACTITIONER-LED Secure coding, purple teaming, tabletop exercises and awareness, built around your stack and the threats that actually apply to you. View service
Compliance
- ISO 27001 PENTESTING FOR ISO 27001 Penetration testing that gives you audit-ready evidence for ISO 27001 (controls A.8.8, A.8.29). Verified findings, retest, reports auditors accept. View service
- ENS PENTESTING FOR ENS Penetration testing for the ENS (RD 311/2022): audit-ready evidence for MEDIUM and HIGH-category systems, with verified findings and retest. View service
- GDPR PENTESTING FOR GDPR GDPR penetration testing that proves your security works and cuts the risk of a personal-data breach. Verified findings, audit-ready evidence, retest. View service
- M&A Cybersecurity Audit M&A CYBERSECURITY DUE DILIGENCE Independent cybersecurity due diligence for M&A: see the risk you’d inherit before you close. Technical assessment and evidence, ready for the data room. View service
Frequently asked questions
What people ask us before the first call.
It depends on the question you need answered. If it is what can be exploited on a specific system, that is a pentest, and there are nine of them depending on the target: web, APIs, cloud, mobile, internal, external, IoT, wireless and AI. If it is whether you would detect and stop a real attacker, that is a red team. If it is proving compliance to an auditor, there are ENS, ISO 27001, GDPR, Microsoft 365 hardening and the M&A cybersecurity audit. And if what is missing is continuous watch, there are dark web monitoring and phishing simulation. If you are not sure, tell us the scenario and we will tell you which one fits.
A pentest searches in breadth across a defined scope: it finds and validates vulnerabilities in an application, an API or a cloud environment, and the goal is to close them. A red team simulates a specific adversary against a specific business objective, and the goal is to measure whether you detect it and whether you stop it. The pentest answers what is exploitable. The red team answers whether you would see them coming.
It comes from the inventory, not from the catalogue. The first thing is knowing what you have exposed: which applications, which APIs, which cloud environments, and what can be seen from outside without authenticating. With that in front of you the scope almost orders itself, because what gets tested first is whatever an attacker would come through first. If you do not have that inventory to hand, that is exactly the conversation to start from.
The price comes from the scope, the complexity and the type of test, whether black box, grey box or white box. We do not publish a rate card, because a number without your scope in front of it means nothing. The specific terms of each service are on its own page, which is where they are kept up to date. Tell us what you want tested and on what, and the first thing that comes out of it is the scope.
Yes, and it has a family of its own: ENS, ISO 27001 and GDPR each have their own page, and so do Microsoft 365 hardening and the cybersecurity audit for M&A deals. When what the standard asks for is a technical test, the work is the same pentest as always, with the deliverable in the format the auditor expects to find.
Get your questions answered
A 30 minute session with our team to understand your situation, answer your questions and define the scope of what you need.
Book a sessionTell us about your project
Fields marked with * are required.
Protected by reCAPTCHA. The Google Privacy Policy and Terms of Service apply.
Message received.
Thanks. We reply within one business day.
Could not send. Please try again or email us.