Yes, to organise the scan results and write a report that is clearer and quicker to read.

We decide together what information is used, and I only access what is strictly necessary for the analysis.

No. The report is designed to be clear, visual and easy to read, with plain explanations and no technical jargon.

You’ll know what is happening, why it matters, what to do and, if asked, how to explain it to a client or your insurer.

Three options, you decide: you apply them yourself following the report, I apply them, or I advise your usual technician so they implement them correctly.

I adapt to your system and the way you work, without making you hire anything you don’t need.

This service detects technical vulnerabilities and proposes actions to reduce risk, but security goes further: policies, staff training, backups, access control…

The Essential package is a key first step and often the most urgent one. From here we can build the rest.

I work with Windows and Linux servers, virtualised systems, networked environments, websites and SaaS tools that are critical to your business.

If you’re not sure exactly what you have, don’t worry: we’ll look at it together before starting, with no commitment.

It cross-checks the scan results against your systems and your regulations, proposes a remediation order and prepares the first draft of the documentation.

I review every proposal before taking it to your team: we save time without losing judgement.

Yes. I integrate without replacing anyone. I detect, document, prioritise and assign tasks, working with your team in a coordinated way and respecting its internal workflow.

My role is to complement, not compete. If you already have a technician, I make their life easier with order and traceability.

I adapt to the agile tools your team already uses (Jira, Redmine, Trello, Asana or similar) and to methods compatible with compliance frameworks such as ISO 27001 or NIS2.

What matters is a clear, productive workflow that leaves auditable evidence.

It’s a shared decision.

I propose an order based on technical risk, business impact and regulatory requirements, but we always agree together on what fits best with your goals and the deadlines of your clients or auditors.

Of course. I produce reports with the status of each task, dates, owners, evidence and results, adapted to the reader: technical detail for your IT team and an executive summary for management or your regulated client.

You can follow progress in real time or receive summaries whenever you need them.

Yes. I work with complete confidentiality and discretion: I only access what is strictly necessary and every finding stays between your team and me.

So you can share the details of your systems with peace of mind.

Yes. I work in English, Spanish and German, so international companies, startups and expats in Madrid can explain what they need and receive their reports in their own language.

On site in Madrid or remotely, whichever suits you best.

More than it seems. Any data your team pastes into an AI tool leaves your company, and that affects the GDPR, DORA’s ICT third-party risk management, ENS controls and the EU AI Act, which has already started to apply.

I review how your team uses generative AI, assess the risks (data leaks, manipulated instructions, unauthorised tools), configure the technical controls and document everything so it holds up before an auditor.

Yes. As well as detailed technical reports for your team, I produce executive reports for the CISO, CIO, management, risk committee and, if you need them, external auditors or regulators.

Focused on decisions, timelines, risks and evidence of regulatory compliance.

My vulnerability assessment service in Madrid helps you meet the technical requirements of DORA, NIS2, ENS, NIST and ISO 27001/27002.

I don’t replace a formal audit or issue certificates, but I strengthen the traceability, documentation and technical evidence your auditor or regulator needs to see. And I drastically reduce surprises on inspection day.

I adapt to the way you work: tools, teams, workflows, priorities and internal policies.

I don’t impose processes: I organise them from within, without disrupting what already works or creating friction with your compliance or internal audit team.

I work in parallel with your external auditor, compliance consultancy or DPO without stepping into their role. I provide the technical layer and the operational evidence; they validate formal compliance.

I have worked in banking environments under European regulation, so I understand the timelines, language and documentation an auditor or regulator expects to see.