Cybersecurity

An audit reviews configurations, processes, and compliance against a standard (ISO, NIST, PCI). A pentest simulates a real attack: it exploits vulnerabilities to demonstrate how far an attacker can get. Ideally they are done together — the audit detects weaknesses on paper, the pentest validates them in practice.

Tests are run within agreed time windows. For critical systems we work in staging environments that replicate production. When we test against production, we avoid denial-of-service techniques and coordinate with your IT team in real time via a dedicated channel.

With two reports: an executive summary in Spanish for management (business risks, impact, prioritized recommendations) and a technical report for IT (exact reproduction steps, commands, screenshots, proof-of-concept code, and concrete fixes per finding). At the end we present the results in a meeting with your team.

Yes, when it's authorized by company management with a formal authorization letter. It's part of security programs accepted globally. What is NOT legal is running it without written authorization. We require that document before starting and work under clear ethical rules (no public exposure of individuals, focus on learning).

At the moment of the click, they see a learning page explaining what the simulation was, what warning signs were in the email, and how to recognize it next time. Individual-level results remain confidential between the employee and HR — no lists are published. At the aggregate level, management sees trends by area to focus training.

Teams without prior training typically have click rates of 20-40%. After focused training and 2-3 simulation cycles, it drops to 5-10%. More importantly, the "report" rate rises (employees who receive the email and report it to IT), which is the most operationally useful metric.

These are three DNS standards for authenticating email. SPF declares which servers are allowed to send email on behalf of your domain. DKIM cryptographically signs every outgoing email. DMARC tells the receiving server what to do if SPF or DKIM fail (reject or quarantine). Without these three, anyone can send email impersonating your domain.

Yes, significantly. In addition to Google/Microsoft's native configuration, we add layers such as reputation-based filters, up-to-date blocklists, and content analysis. On average, businesses reduce spam reaching the inbox by 60-80%, with less than 1% false positives (legitimate emails misclassified).

Filters are calibrated with whitelisting for known supplier domains and a fast release process for false positives. The administrator can review the quarantine and release legitimate emails within seconds. We also recommend that your critical suppliers set up their own DMARC to reduce false positives.

All three work, and we offer them based on your preference. In-person sessions have higher engagement and allow for richer group exercises. Live remote sessions work well for distributed teams. Recorded/asynchronous sessions suit large companies with schedules that are impossible to coordinate. We recommend a mix: recorded introduction + live workshop + follow-up practice.

General awareness programs: 2-3 initial hours plus 15 minutes a month (refresher pills). Specific technical training: 1-2 days depending on the topic. The key isn't the number of hours but consistency: regular 15-minute monthly sessions beat a full day once a year.

Yes. Each participant receives a personal certificate stating hours, topics covered, and date. The company receives a consolidated report with attendance, assessment results, and documented evidence — accepted by ISO 27001, SOC 2, and similar framework auditors as evidence of awareness training controls.

It depends on size, scope, and current maturity. SMEs with good practices already in place: 6-9 months. Companies starting from zero in formal security: 12-18 months. The timeline is shaped as much by the pace of internal implementation as by our work; if leadership prioritizes resources, timelines shorten.

No. The official certification is issued by an accredited certification body (BSI, TÜV, Bureau Veritas, DNV, etc.) — this is an independence requirement. We prepare your company to pass that audit. We have experience with several certification bodies and know what they expect in practice, not just in theory.

ISO 27001 is an international standard, globally recognized, common in Europe, LATAM, and Asia. SOC 2 is specific to the North American market, heavily required by B2B clients in the US. If you sell to US companies, go with SOC 2. If your clients are global or European, go with ISO 27001. Many companies pursue both in parallel since they share 70% of controls.