Frequently asked questions

The usual starting point is the exposure assessment. We review from the outside what an attacker can see of your company: domains, email, services exposed on the internet, leaked passwords, your Microsoft 365 or Google Workspace configuration and the state of your backups. Nothing needs to be installed on your devices. You receive a report for management and a prioritised plan, and with that you decide where to invest first.

No. The plan is yours and anyone you choose can carry it out, whether your own team or your IT provider. It is written for exactly that, with the actions ordered by priority. If you later take on another service with us, we start from that assessment. Bear in mind that fixing the issues found is not part of the assessment and is quoted separately.

Between 2 and 3 weeks from when the scope is signed, depending on the number of applications and systems included in the test. Beforehand, we agree in a meeting what will be tested, when and within what limits, and we sign the authorisation. At the end we deliver an executive report for management and a technical report for your team, and we recheck the serious flaws once they have been fixed.

A vulnerability scan is an automated review that lists possible flaws. In a penetration test, a person checks by hand which of them can actually be exploited and how far an attacker could get. Each finding is delivered with its evidence, its severity and how to fix it. The fixing is done by your team or quoted separately, because it is not part of the test.

It depends on what the review covers. For the exposure assessment, what counts is the number of domains and users; for a penetration test, the applications and systems being tested. We do not give prices on this page: call us, tell us what your company is like and we will tell you how to proceed. The final price is agreed in writing before we start.

According to what needs to be covered. Monitoring fees depend on your devices and servers; backups, on the volume of data and the systems; Microsoft 365 or Google Workspace, on the users and domains; security awareness, on the number of people. For compliance we look at the standard, your size and what you already have in place, and the fixed quote reaches you in writing within 48 hours of the assessment.

The assessment is delivered in 5 working days. Microsoft 365 or Google Workspace is hardened in 1 week from when we have administrator access. Backups are put in place in 2 weeks, and the initial phishing campaign also starts within 2 weeks. The 24/7 monitoring service goes live in 10 days, counted from when we have the device inventory and the access we need.

No. The monthly services have no minimum term. 24/7 monitoring is paid month by month and you can stop whenever you like, and there is no minimum term for backups or for the outsourced security lead either. You can pay by bank transfer or by card, and the prices we quote you do not include VAT (21%). If you have questions about the terms, call us.

Antivirus blocks what it recognises and leaves an alert. With a managed SOC, those alerts are reviewed, what the antivirus cannot see is investigated, and action is taken when an attack is under way. We monitor alerts 24 hours a day, 7 days a week, analyse each one to rule out false alarms and send a monthly activity report for management.

What matters is being able to restore. We test your current backups and tell you whether they work, how long a restore would take and what is missing. If you take on the service, we set up automatic immutable backups away from your premises, which cannot be modified or deleted for the set period, and regular recovery tests with the time they take recorded in writing. We also check that each backup completes successfully and alert you if one fails.

Mainly two-factor authentication, which is switched on with advance notice and a simple guide. The rest of the changes are barely noticeable in day-to-day work. Before anything is touched, you approve a change plan, and the changes are rolled out in stages so that nobody is locked out. When we finish, we deliver a document listing each change and how to maintain it, for your team or your IT provider.

Management knows at all times what is being sent and when. Staff are told about the programme, but not the date of each simulation, so that the results are genuine. The report for management gives aggregated results, and anyone who falls for a simulation receives brief refresher training. The sessions are short and can be held remotely.

Call the incident line as soon as possible; it is staffed 24 hours a day, 7 days a week. Do not delete anything or reinstall devices: disconnect them from the network and wait for instructions, because the evidence helps establish what happened. We give a first response in under 4 hours during business hours. After that we contain the attack, investigate its source and help you get back up and running.

Yes. Incident response can be engaged on the spot, without having any other service with us. The first intervention includes up to 8 hours of work. If more is needed, we give you a written quote before going any further. It does not include the full reinstallation of devices and applications, which is quoted case by case, or legal representation before authorities or courts.

If personal data is affected, the GDPR requires you to notify the AEPD (Spanish data protection authority) within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals. It is also advisable to report it to the police and to inform your insurer. We help you prepare each notification, preserve the evidence in case a police report is needed and deliver a final report for management and for the insurer.

It depends on the backups. If there are backups the attacker has not reached, the files are restored from them. Without backups, recovery is not always possible, and we will tell you so plainly from the outset. That is why it is worth having immutable backups, which cannot be modified or deleted for the set period, and regularly testing that you can restore from them.

It depends on your sector and size. The NIS2 Directive applies to medium-sized and large companies in the sectors listed in its Annexes I and II, and only in some cases to small ones. As of 6 November 2026, the Spanish law transposing the directive has not been published in the BOE (Spain's Official State Gazette). We can review it with you in a consultation, but legal advice on whether a specific law applies to you is not part of our service.

For the basic category, a declaration of conformity, which is a self-assessment, is enough. For the medium and high categories, certification is required, with an audit by a certification body. We prepare the company: gap analysis, work plan, policies, evidence and a prior internal audit. Preparing for compliance takes 3 to 6 months, depending on the standard and the size of the company.

We do not certify: ISO/IEC 27001 or ENS certification is issued by an independent certification body. We prepare the company and support it through the audit. If you need to know whether we hold a particular accreditation, ask us by phone or by email. When comparing providers, it is good practice to ask for the exact name of each certification, its scope and its date.

The exposure assessment is the basis: it tells you what you can state today and what is worth fixing before you reply. Completing the full questionnaire is part of the compliance service, and the outsourced security lead (vCISO) also takes it on if you have that service. It is a common request, because companies affected by NIS2 ask their suppliers to demonstrate their security.

An outsourced information security lead. They do the security management work that an in-house CISO would do, with the time commitment the company needs. They do not replace your IT team: that team maintains the systems, while the vCISO sets the security priorities, coordinates them and is accountable to management. They meet every month with the member of management you designate.

We work remotely anywhere in Spain and on site in the Comunidad de Madrid. An internal penetration test is carried out connected to your network, remotely or in person. If there is an incident in the Comunidad de Madrid, we can come to your premises in person if needed; in the rest of Spain we work remotely. Training sessions can also be held remotely or in person in the Comunidad de Madrid.

No. No provider can guarantee that a company will not suffer an incident. What can be done is to reduce what is left exposed, detect sooner, respond with a set procedure and recover with tested backups. That is what our services are for, and with each one you receive a report for management in plain language and a prioritised technical plan, so that you know where you stand.

Oteo is a cybersecurity company based in Móstoles, operating since 2026. Aitor handles management and client relationships. We provide cybersecurity consultancy, IT security audits and a managed security operations centre (SOC). We never publish a client's name or the details of an incident without their written authorisation, which is why this website does not show case studies or logos.