Exposure assessment
We review from the outside what an attacker can see of your company and give you a report for management and a prioritised plan.
- Delivered in 5 working days
- SMEs with 10 to 250 employees
- Nothing to install on your devices
- Report for management
The exposure assessment in Móstoles is the starting point if you want to know where your company stands on security.
We review from the outside what an attacker can see: domains, email, services published on the internet, leaked passwords and the configuration of Microsoft 365 or Google Workspace.
We also check the state of your backups.
Read more Read less
At the end you receive a report for management in plain language and a prioritised technical plan, within 5 working days. Nothing needs to be installed on your devices and we do not launch attacks against your systems. With that plan you decide what to do, in what order and with whom.
Request a quote
To talk about exposure assessment, call or write to us and we'll tell you the next steps.
How we help you
- You do not know which of your company's services are published on the internet or who reviews them.
- A client or an insurer asks you for information about your security.
- You have received a security questionnaire from a client.
- You want an order of priorities before deciding what to invest in.
- You suspect that one of the company's passwords has appeared in a leak.
What an exposure assessment is
Every company leaves a trail on the internet: a domain, some email accounts, a service published for remote working. The assessment gathers that trail and puts it in order.
We review from the outside what an attacker can see of your company: domains, email, services published on the internet and leaked passwords.
Read more Read less
To that outside view we add two checks: the security configuration of Microsoft 365 or Google Workspace and the state of your backups. With all of this we prepare a report for management and a prioritised plan. It is the starting point for the rest of our services.
It is worth being clear: no assessment can guarantee that a company will not suffer an incident. What it does do is show you what is exposed now and what should be dealt with first. That way you can reduce your attack surface in an orderly way rather than on hunches.
Who it is designed for
It is designed for the management of SMEs with 10 to 250 employees.
It fits two situations in particular: you want to know where you stand before investing in security, or you have received a security questionnaire from a client.
In both situations the question is similar: what do we have, what are we missing and where do we start.
That is why the request comes from management, who have to decide what the budget is spent on and what to tell their clients.
Read more Read less
If your company falls outside that range or you have a different need, call us and we will tell you how to proceed.
SMEs with 10 to 250 employees
Common reasons to request it
These are the common reasons for requesting an assessment. If you recognise yourself in any of them, it will help you replace assumptions with facts.
- You do not know which of the company's services are published on the internet or who reviews them.
- A client or an insurer asks you for information about your security.
- You want an order of priorities before deciding what to invest in.
- You suspect that one of the company's passwords has appeared in a leak.
When the request comes from outside, from a client or an insurer, it matters to know what you can state with confidence.
Answering without having checked can lead you to take things for granted that later do not hold up.
Read more Read less
Something similar happens with passwords. A password appearing in a leak does not in itself mean that someone has got into your company. Even so, it is worth knowing so that you can change it and review that account calmly.
How we work, step by step
We start with a call to get to know the company and agree the scope.
Before we review anything, you give us written authorisation of what we are going to review. That way it is clear from the start what the work covers.
Nothing needs to be installed on your devices: the review is done from the outside. It is completed with an interview with your IT person.
Read more Read less
We deliver the report and the prioritised plan within 5 working days. Then we meet to explain the results and answer your questions, so that management knows what each point means before making decisions.
How we get started
- Initial call to get to know the company and agree the scope.
- Written authorisation of what we are going to review.
- External review and an interview with your IT person.
- Delivery of the report and the prioritised plan within 5 working days.
- Meeting to explain the results and answer your questions.
What the assessment includes
We make an inventory of the company's domains, subdomains and services exposed to the internet.
Over the years it is common to build up services that nobody remembers any more, and an inventory lets you decide which ones are still needed.
Read more Read less
We also review your email configuration: SPF, DKIM and DMARC. These are domain settings that help other servers tell your legitimate email apart from email that tries to impersonate you. In addition, we look for company credentials in known public leaks and review the security configuration of Microsoft 365 or Google Workspace.
The interview with the person responsible for your systems covers what cannot be seen from the outside: backups, access and devices. Everything is turned into two documents: a report for management in plain language and a prioritised technical plan ordered by impact and effort. We present them in a meeting with management.
- Inventory of domains, subdomains and services exposed to the internet.
- Review of your email configuration: SPF, DKIM and DMARC.
- Search for company credentials in known public leaks.
- Review of the security configuration of Microsoft 365 or Google Workspace.
- Interview with the person responsible for your systems about backups, access and devices.
- Report for management in plain language.
- Technical plan prioritised by impact and effort.
- Meeting with management to present the results.
Price and timescale
The final price depends on the number of domains and users, and it is fixed in writing before we start. The prices we quote do not include VAT.
The timescale is 5 working days to deliver the report and the prioritised plan.
If you are comparing quotes for this kind of work, it is worth asking three things: how many domains and users are included, which documents you receive at the end and whether fixing the problems is included or separate.
With those answers you can compare like with like.
Delivered in 5 working days
What it does not include
- Active penetration tests against your systems, which are the penetration testing service.
- Fixing the problems found, which is quoted separately.
- Reviewing devices one by one.
Read more Read less
The assessment observes and puts things in order. It does not carry out active penetration tests against your systems: that belongs to the penetration testing service. Nor does it review devices one by one.
Fixing the problems found is not included and is quoted separately. We say so from the start so that you know what you are buying: a picture of the situation and a plan to improve it, with the implementation work kept separate.
Who you will deal with
Aitor heads Oteo and looks after client relationships. If you have questions about the engagement or about how to proceed, your relationship with us goes through him.
On your side, it helps to be clear about who will make the decisions in the company and who knows the systems best, whether that is a member of staff or your IT provider.
Where we work
We work remotely anywhere in Spain and on site in the Comunidad de Madrid, where Móstoles is.
As the review is done from the outside, your location does not change the substance of the work.
If your company is in the Comunidad de Madrid and you prefer to talk in person, tell us on the first call and we will look into it.
Frequently asked questions about the assessment
These are the questions worth settling before you commission an assessment: whether anything has to be installed, whether work is interrupted, what you receive and whether you have to buy anything afterwards.
If your question is not on the list, call us and we will tell you how to proceed.
Questions about exposure assessment
Do I need to install anything on my devices?
No. The review is done from the outside, using what anyone can see on the internet, plus read-only access to Microsoft 365 or Google Workspace that you give us.
Can it disrupt the company's work?
No. The assessment does not launch attacks or tests that could affect service: it observes and reviews configurations.
What do I receive at the end?
A report for management in plain language and a technical plan with the actions ordered by priority, so that your team or your IT provider can carry it out.
Do I have to buy anything afterwards?
No. The plan is yours and anyone you choose can carry it out. If you later take on another service with us, we start from this assessment.
How much does it cost?
The final price depends on the number of domains and users, and it is fixed in writing before we start. Call us, tell us what your company is like and we will tell you how to proceed.
Can I use it to answer a client's security questionnaire?
It works as a basis: it tells you what you can state today and what is worth fixing before you answer. The complete answer to the questionnaire is part of the compliance service.
How long does it take?
We deliver the report and the prioritised plan within 5 working days. Then we meet with you to explain the results and answer your questions.
Is fixing what you find included?
No. Fixing the problems found is quoted separately. The plan is yours, so whoever you choose can also take care of it.
Penetration testing
Controlled, authorised penetration tests on your website, your applications or your infrastructure.
NIS2, ENS and ISO 27001 compliance
We prepare your company for NIS2, ENS or ISO/IEC 27001 and support you through the audit.
Microsoft 365 and Google Workspace security
We review and strengthen the configuration of your Microsoft 365 or Google Workspace: access, email and devices.
Backup and continuity
Immutable backups stored off your premises and recovery tests with the time measured.
How to request your assessment
Call us on +34 699 240 879 or email [email protected] and tell us what you need to know about your company.
It will help to have three details to hand: how many domains the company uses, how many users it has and whether it works with Microsoft 365 or Google Workspace.
If you do not have them all, call us anyway and we will tell you how to proceed.