Offensive Security
We think like your most patient adversary to find the crack before they do.
- Red Team
- Pentesting
- Social engineering
- Assumed Breach
Can you get us ENS certified before the tender?
Yes. We audit, implement and guide you to ENS certification in 90 days, without stopping your operations.
- 15-min response
- Barcelona & all of Europe
- No lock-in
The front line of defence for those who cannot afford to stop
- MERIDIAN
- Altamar Capital
- NØRD
- Iberia Re
- HALCYON
- Grupo Vela
- Banca Ostra
- KALDERA
- Fundación Solar
We prepare, audit and certify you in
Best price guarantee
We beat the price of any competitor.Period.
Solutions
Four risks. Solved before they cost you money.
Blocked today
1,284
- Leaked passwords testedBrazil → Microsoft 365Blocked
- Vulnerability exploitChina → Perimeter firewallBlocked
- Email with malicious linkNigeria → Finance departmentBlocked
- Brute-force remote accessRussia → Corporate VPNBlocked
Choose your front. See Custodia in action.
Defence and Response
Managed detection and a response team that arrives in minutes, not days.
- MDR 24/7
- Incident response
- Threat Hunting
- Forensics
Governance and Risk
Compliance that survives a real audit and translates into board decisions.
- NIS2
- DORA
- ISO 27001
- CISO as a Service
Regulatory compliance
Twelve frameworks. Zero fines across our portfolio.
From gap analysis to audit day. We sit in the room with the certifier and answer for every control.
- Certification
ISO/IEC 27001
Information security management system
Required in tenders and enterprise contracts - Public sector
Spanish National Security Framework
Royal Decree 311/2022
Mandatory for public administration suppliers - EU regulation
NIS2 Directive
Directive (EU) 2022/2555
Up to €10M or 2% of global turnover - Financial sector
Digital operational resilience
Regulation (EU) 2022/2554
TLPT testing and ICT third-party risk - Privacy
GDPR + LOPDGDD
Regulation (EU) 2016/679
Up to €20M or 4% of global turnover - SaaS · US
SOC 2 Type II
AICPA Trust Services Criteria
Required to sell to North American customers - Payments
PCI DSS v4.0.1
PCI Security Standards Council
Mandatory if you process card payments - Certification
ISO/IEC 27701
Privacy information management
Proves GDPR compliance to third parties - Certification
ISO 22301
Business continuity
A tested plan for ransomware and outages - Automotive
TISAX
ENX Association · VDA ISA
Required for automotive suppliers - Artificial intelligence
ISO/IEC 42001
AI management systems
The foundation for AI Act compliance - EU regulation
EU AI Act
Regulation (EU) 2024/1689
Up to €35M or 7% of global turnover
Exposure calculator
What would non-compliance cost you?
Maximum fines are calculated on the group’s global turnover. Move the slider and see what is at stake.
€10M€2,000M
Maximum fine in the worst case
€35.0M
- GDPR · 4% of turnover or €20M€20.0M
- NIS2 · essential entity · 2% of turnover or €10M€10.0M
- NIS2 · important entity · 1.4% of turnover or €7M€7.0M
- AI Act · prohibited practices · 7% of turnover or €35M€35.0M
Indicative maximum amounts. They exclude the cost of the incident, downtime and reputational damage.
Reduce my exposureEuropean insurer contains ransomware before encryption
41 min
From alert to full containment
Venture capital fund passes its first DORA audit with no findings
0
Non-conformities in the regulatory audit
Energy operator shrinks its exposed attack surface
−83%
Critical assets exposed to the internet
“We hired three big consultancies before. Custodia was the only one that came in like a real attacker.”
“At three in the morning, Custodia’s team was already inside the network. By four, the attacker was out.”
Small on purpose.
Twenty-two specialists. No juniors on your account. We take on a limited number of clients each year so every one of them gets our best operators.
Trust centre- OSCE³ and CRTO certified operators
- 100% EU-based team
- End-to-end encrypted data
- No subcontracting
- Response in under 30 min
- Signed rules of engagement
- Independently audited every year