Pricing
The price depends on the scope: domains, users, devices or systems. Call or write to us and we'll tell you the next steps. After the assessment, we give a fixed written quote within 48 hours.
Quotes by service
Exposure assessment
We review from outside what an attacker can see of your business and deliver the report and the prioritised plan in 5 working days. It is the starting point for all our other services. The final price depends on the number of domains and users.
- Inventory of domains, subdomains and services exposed to the internet
- Review of the email configuration: SPF, DKIM and DMARC
- Search for company credentials in known public data leaks
- Review of the Microsoft 365 or Google Workspace security configuration
- Report for management in plain language
- Prioritised technical plan, ordered by impact and effort
Penetration testing
Controlled, authorised intrusion tests on your website, your applications or your infrastructure. A penetration test takes 2 to 3 weeks depending on the scope. The price depends on what is included in the test and is fixed in writing before work begins.
- Scoping meeting and signed authorisation document
- Website and application testing using public methodologies such as OWASP's
- Testing of external infrastructure, internal infrastructure or both, as agreed
- Each finding rated by severity, with the evidence that proves it
- Executive report for management and technical report for your team
- Retesting of serious flaws once they have been fixed
24/7 monitoring and response
Managed security operations centre (SOC) for SMEs: we monitor alerts 24 hours a day, 7 days a week and, if an attack is real, we contain it and let you know. Setup takes 10 days. The price depends on how many devices and servers need monitoring. No minimum term.
- Detection and response agent on each covered device and server
- Analysis of every alert to rule out false alarms
- Containment of compromised devices, for example by isolating them from the network
- Notification to the contact person you designate
- Monthly activity report for management
Incident response
For when something has already happened: ransomware, email account takeover or CEO fraud. We give a first response in under 4 hours during business hours, and you do not need to be a client. The first intervention includes up to 8 hours of work; if more is needed, we give you a written quote before continuing.
- Incident line staffed 24 hours a day, 7 days a week
- Containment: isolating devices, cutting off access and changing credentials
- Investigation of the origin and scope of the incident
- Preservation of evidence in case it has to be reported to the police
- Support with notifying the AEPD if personal data is affected
- Final report for management, for your insurer and, if needed, for the police report
Microsoft 365 and Google Workspace security
We review and strengthen your Microsoft 365 or Google Workspace configuration within 1 week of receiving administrator access. The price depends on the number of users and domains.
- Review of the current configuration against the vendor's public recommendations
- Two-factor authentication for all users
- SPF, DKIM and DMARC set up on your domain
- Email protection against phishing and malicious attachments
- Rules for the devices that access company data
- Document listing the changes made and how to maintain them
Backup and continuity
Immutable backups, which cannot be modified or deleted during the set period, and a recovery plan with times measured in real tests. Implementation takes 2 weeks. The price depends on the volume of data and the systems being backed up. No minimum term.
- Review of what needs backing up and how often
- Automatic immutable backups stored away from your premises
- Backup of Microsoft 365 or Google Workspace email and documents
- Regular recovery tests, with the time they take recorded in writing
- Recovery plan with the steps and the people responsible for getting back to work
- Monitoring that each backup completes successfully, with an alert if it fails
Security awareness and phishing simulation
Practical training for your staff and phishing email simulations to measure who clicks and reinforce where needed. The initial campaign is launched within 2 weeks. The price depends on the number of people.
- Initial phishing simulation to measure the starting point
- Short training sessions, remotely or in person in the Comunidad de Madrid
- Regular simulations throughout the year
- Refresher training for anyone who falls for a simulation
- Aggregated results of each campaign for management
- Record of the training as evidence for audits
NIS2, ENS and ISO 27001 compliance
We prepare your business to comply with NIS2, Spain's National Security Framework (ENS) or the ISO/IEC 27001 standard. It takes 3 to 6 months depending on the standard and the size of the business. It is quoted after the assessment, because it depends on the standard, the size and what you already have in place. Certification is issued by an independent certification body.
- Gap analysis between your current situation and the chosen standard
- Work plan with priorities, owners and dates
- Policies and procedures tailored to your business
- Preparation of the evidence the auditor asks for
- Internal audit ahead of the certification audit
- Support during the certification audit
- Answers to clients' security questionnaires
Outsourced security lead (vCISO)
A person responsible for your company's security without hiring them full time: they set priorities, run the security plan, coordinate suppliers, answer clients and auditors and report to management. The price depends on the size of the business and the time commitment. No minimum term.
- Annual security plan with priorities and budget
- Monthly follow-up meeting with the member of management you designate
- Quarterly review of the plan and the risks
- Coordination of IT and security suppliers
- Answers to security questionnaires from clients and insurers
- Company security policies and keeping them up to date
You will not see amounts here: each service is quoted according to its scope, such as the number of domains, users or devices, or what is included in the test. We provide a fixed written quote within 48 hours of the assessment. Call us on +34699240879 or email us at hola@oteosecurity.com and we will tell you how to proceed. See questions about payments and timescales.
Payments and timescales
What people usually ask about how each service is paid for and how long it takes.
How is each service quoted?
According to what needs to be covered. Monitoring fees depend on your devices and servers; backups, on the volume of data and the systems; Microsoft 365 or Google Workspace, on the users and domains; security awareness, on the number of people. For compliance we look at the standard, your size and what you already have in place, and the fixed quote reaches you in writing within 48 hours of the assessment.
How much does a cybersecurity audit cost?
It depends on what the review covers. For the exposure assessment, what counts is the number of domains and users; for a penetration test, the applications and systems being tested. We do not give prices on this page: call us, tell us what your company is like and we will tell you how to proceed. The final price is agreed in writing before we start.
How long does each service take to get up and running?
The assessment is delivered in 5 working days. Microsoft 365 or Google Workspace is hardened in 1 week from when we have administrator access. Backups are put in place in 2 weeks, and the initial phishing campaign also starts within 2 weeks. The 24/7 monitoring service goes live in 10 days, counted from when we have the device inventory and the access we need.
Is there a minimum contract term for the monthly services?
No. The monthly services have no minimum term. 24/7 monitoring is paid month by month and you can stop whenever you like, and there is no minimum term for backups or for the outsourced security lead either. You can pay by bank transfer or by card, and the prices we quote you do not include VAT (21%). If you have questions about the terms, call us.
Am I obliged to buy anything after the assessment?
No. The plan is yours and anyone you choose can carry it out, whether your own team or your IT provider. It is written for exactly that, with the actions ordered by priority. If you later take on another service with us, we start from that assessment. Bear in mind that fixing the issues found is not part of the assessment and is quoted separately.
Can I get help with an incident without being a client?
Yes. Incident response can be engaged on the spot, without having any other service with us. The first intervention includes up to 8 hours of work. If more is needed, we give you a written quote before going any further. It does not include the full reinstallation of devices and applications, which is quoted case by case, or legal representation before authorities or courts.
How much would yours cost?
Tell us what your company does, how many users and devices it has and what you need.
Read more Read less
Call or write to us and we'll tell you the next steps.