Question 1

What do you do?

Accepted Answer

We help mid-size companies in Spain understand their cybersecurity risks and fix them, one priority at a time. We start with a roadmap: what to fix first, who does it and by when. Then we help you follow it, and prove it to your customers, auditors and insurers.

Question 2

Who do you work with?

Accepted Answer

Mid-size companies in healthcare, legal, industrial, tech and SaaS, e-commerce and financial services. You do not need a security team. We work with your IT people, or act as your security lead.

Question 3

Do you only work in Spain?

Accepted Answer

For now, yes. Focusing on one country lets us know the local rules, such as ENS and the RGPD, and work in Spanish or English. If your company is based elsewhere, tell us when you book and we will say honestly whether we can help.

Question 4

What is the discovery call?

Accepted Answer

A one-to-one call where we walk through what we found on your website, what it could mean for your business, and how we would fix it. It is free, and the booking calendar shows the length before you book.

Question 5

Why did we get an email from you?

Accepted Answer

We contact companies when we notice a security problem in information that is publicly visible on their website. We do not access anything that is not public. If you would rather not hear from us, reply “stop” and we will not contact you again.

Question 6

How does it start?

Accepted Answer

You book a discovery call. On the call we go through what we noticed on your website and how we could fix it, and you leave with a clear next step. If you want to go ahead, we send a scoped proposal with a fixed price or a monthly fee.

Question 7

Do you work with small companies?

Accepted Answer

We focus on mid-size companies. If you are smaller, tell us on the call and we will say honestly whether we can help. If we cannot, we will point you to free resources, such as the basic tools INCIBE offers to small businesses.

Question 8

What is a security roadmap?

Accepted Answer

A short, ranked list of what to fix, in plain language, with who does what, by when, and roughly what it costs. It replaces the 100-page report nobody reads.

Question 9

What are the five steps?

Accepted Answer

Assess (where you stand), Prioritise (what matters first), Fix (close the gaps), Prove (evidence for customers and auditors) and Maintain (monitoring and regular reviews). You can buy one step on its own, or all five.

Question 10

Do we need our own security team?

Accepted Answer

No. We work alongside your IT team and suppliers. If you have nobody leading security, we can act as your fractional security lead (vCISO) for a monthly fee.

Question 11

How long does it take?

Accepted Answer

It depends on your size and where you start. The assessment produces your first roadmap, and every proposal states the timeline before you commit.

Question 12

Which standard do we need: SOC 2, ISO 27001 or PCI DSS?

Accepted Answer

It depends on who is asking. Online shops that take card payments need PCI DSS. Tech companies selling to large customers are usually asked for SOC 2 or ISO 27001. Some public-sector work in Spain requires ENS. We tell you which ones apply to you, and which do not.

Question 13

Can you get us certified?

Accepted Answer

We get you ready: gap analysis, policies, controls and evidence. The certificate or audit report itself is issued by an independent auditor or certification body, not by us.

Question 14

Can you help us pass a customer’s security review?

Accepted Answer

Yes. We help you answer security questionnaires, gather the evidence, and fix the gaps the review exposes.

Question 15

Is NIS2 in force in Spain?

Accepted Answer

The EU directive applies across Europe, but as of September 2026 Spain’s national law had still not been finalised. We will tell you if and when your company falls in scope, and what it means for you.

Question 16

Where does our data go?

Accepted Answer

We use EU-hosted or on-premises tools and work under a data processing agreement that meets the RGPD. We only access what the work needs.

Question 17

Do you offer 24/7 monitoring?

Accepted Answer

Yes, through managed detection and response, as a monthly service.

Question 18

Do you report the vulnerabilities you find?

Accepted Answer

We report them to you first, privately. If a weakness could affect others, we follow coordinated disclosure, including INCIBE-CERT where relevant.

Question 19

What if we are under attack right now?

Accepted Answer

Email support@attackless.com with “Incident” in the subject. Incident response is one of our services, but we cannot promise emergency response without an agreement in place. For an active attack in Spain you can also report to INCIBE-CERT.

Question 20

How is pricing structured?

Accepted Answer

A fixed price per step or project, or a monthly fee for ongoing work such as monitoring or a fractional security lead. We quote after a short call, so there are no surprises.

Question 21

Will you sign an NDA?

Accepted Answer

Yes, on request, before you share anything sensitive.

Newsroom

FAQ

Book a call