Question 1

¿Qué hacen?

Accepted Answer

Ayudamos a empresas medianas en España a entender sus riesgos de ciberseguridad y a corregirlos, una prioridad cada vez. Empezamos con una hoja de ruta: qué corregir primero, quién lo hace y para cuándo. Después le ayudamos a seguirla y a demostrarlo ante sus clientes, auditores y aseguradoras.

Question 2

¿Con quién trabajan?

Accepted Answer

Con empresas medianas de sanidad, jurídico, industria, tecnología y SaaS, comercio electrónico y servicios financieros. No necesita un equipo de seguridad. Trabajamos con su equipo de TI o hacemos de responsable de seguridad.

Question 3

Do you only work in Spain?

Accepted Answer

For now, yes. Focusing on one country lets us know the local rules, such as ENS and the RGPD, and work in Spanish or English. If your company is based elsewhere, tell us when you book and we will say honestly whether we can help.

Question 4

What is the discovery call?

Accepted Answer

A one-to-one call where we walk through what we found on your website, what it could mean for your business, and how we would fix it. It is free, and the booking calendar shows the length before you book.

Question 5

Why did we get an email from you?

Accepted Answer

We contact companies when we notice a security problem in information that is publicly visible on their website. We do not access anything that is not public. If you would rather not hear from us, reply “stop” and we will not contact you again.

Question 6

¿Cómo empieza?

Accepted Answer

Reserva una llamada inicial. En ella repasamos lo que hemos visto en su web y cómo podríamos corregirlo, y usted sale con un siguiente paso claro. Si quiere seguir adelante, le enviamos una propuesta cerrada con precio fijo o cuota mensual.

Question 7

Do you work with small companies?

Accepted Answer

We focus on mid-size companies. If you are smaller, tell us on the call and we will say honestly whether we can help. If we cannot, we will point you to free resources, such as the basic tools INCIBE offers to small businesses.

Question 8

¿Qué es una hoja de ruta de seguridad?

Accepted Answer

Una lista corta y ordenada de qué corregir, en lenguaje claro, con quién hace qué, para cuándo y más o menos cuánto cuesta. Sustituye al informe de 100 páginas que nadie lee.

Question 9

What are the five steps?

Accepted Answer

Assess (where you stand), Prioritise (what matters first), Fix (close the gaps), Prove (evidence for customers and auditors) and Maintain (monitoring and regular reviews). You can buy one step on its own, or all five.

Question 10

Do we need our own security team?

Accepted Answer

No. We work alongside your IT team and suppliers. If you have nobody leading security, we can act as your fractional security lead (vCISO) for a monthly fee.

Question 11

How long does it take?

Accepted Answer

It depends on your size and where you start. The assessment produces your first roadmap, and every proposal states the timeline before you commit.

Question 12

Which standard do we need: SOC 2, ISO 27001 or PCI DSS?

Accepted Answer

It depends on who is asking. Online shops that take card payments need PCI DSS. Tech companies selling to large customers are usually asked for SOC 2 or ISO 27001. Some public-sector work in Spain requires ENS. We tell you which ones apply to you, and which do not.

Question 13

Can you get us certified?

Accepted Answer

We get you ready: gap analysis, policies, controls and evidence. The certificate or audit report itself is issued by an independent auditor or certification body, not by us.

Question 14

Can you help us pass a customer’s security review?

Accepted Answer

Yes. We help you answer security questionnaires, gather the evidence, and fix the gaps the review exposes.

Question 15

Is NIS2 in force in Spain?

Accepted Answer

The EU directive applies across Europe, but as of September 2026 Spain’s national law had still not been finalised. We will tell you if and when your company falls in scope, and what it means for you.

Question 16

Where does our data go?

Accepted Answer

We use EU-hosted or on-premises tools and work under a data processing agreement that meets the RGPD. We only access what the work needs.

Question 17

Do you offer 24/7 monitoring?

Accepted Answer

Yes, through managed detection and response, as a monthly service.

Question 18

Do you report the vulnerabilities you find?

Accepted Answer

We report them to you first, privately. If a weakness could affect others, we follow coordinated disclosure, including INCIBE-CERT where relevant.

Question 19

What if we are under attack right now?

Accepted Answer

Email support@attackless.com with “Incident” in the subject. Incident response is one of our services, but we cannot promise emergency response without an agreement in place. For an active attack in Spain you can also report to INCIBE-CERT.

Question 20

¿Cómo se fija el precio?

Accepted Answer

Un precio fijo por paso o proyecto, o una cuota mensual para el trabajo continuo, como la monitorización o un responsable de seguridad a tiempo parcial. Presupuestamos tras una llamada breve, sin sorpresas.

Question 21

Will you sign an NDA?

Accepted Answer

Yes, on request, before you share anything sensitive.

Noticias

Preguntas frecuentes

Reservar llamada inicial