We support you end to end. With leadership, to decide what to protect and why. With your team, so it works day to day. Or at exactly the point where you need us.
Security isn't built by piling up controls. It starts from the business, is decided with leadership and is sustained by the team. We can cover the whole chain with you, or step in at the link you need.
With senior leadership
With your team
Business
What the organization wants to achieve, and which processes and assets support it.
Risk
What could prevent it, framed in scenarios everyone can understand.
Objectives
What security needs to achieve, given how much risk leadership is willing to accept.
Capabilities
What the organization must be able to do in a repeatable way, without improvising.
Strategy
How, and in what order, the gaps get closed.
Program
Initiatives, owners and governance to execute it.
Controls
Policies, processes and technical measures in day-to-day operations.
Measurement
Signs that it's working, and when to adjust.
Improvement
What gets fixed and adjusted based on what is measured.
And when the business changes, we start over.
Where does your organization stand today?
There's no single starting point. Pick the one closest to yours.
A clean slate is an advantage
We start by understanding your business and which information, processes and providers support it. With that we set priorities and build the essentials, with clear owners, policies that are actually applied and controls proportionate to risk.
We define the scope, which can be your organization, your platforms or your products. We help with questionnaires and meetings, strengthen whatever needs it and, if you need formal assurance, carry out an evidence-based assessment.
Security leadership, without adding an executive role
We take on security leadership on a recurring basis. We run the agenda, the risks and the policies, support leadership and answer to clients and auditors, without you having to hire a full-time executive.
We start from the business and its risks to define objectives, capabilities and priorities. We document it in a strategy that leadership can approve, defend and review when the context changes.
We prepare you for ISO/IEC 27001 or a SOC 2 report, with gap analysis, policies, controls, evidence and internal audit. We have experience guiding organizations all the way to ISO/IEC 27001 certification. Certification is granted by an accredited body.
First we identify your critical assets, what must be protected and recovered before anything else. On that basis we design the response plan, with clear roles, analysis and containment mechanisms, internal and external communication, and a record of every stage. Then we keep it current and put it to the test.
We help you align the SOC with your incident response plan and the risks that matter most, so that every relevant alert reaches whoever has to decide and turns into a clear action.
We attack your websites, applications, APIs, networks and cloud environments the way a real attacker would, with authorization. Every finding comes with evidence, priority by business risk and a retest that confirms the fix works.
Each can be contracted on its own. When it makes sense, we combine them.
Ongoing service
vCISO
An external security leadership function for your organization. We put risks in order, sustain a security agenda and help you decide with business judgment, without you having to hire a full-time executive.
It doesn't replace technical operations. 24/7 monitoring, systems administration, forensic analysis or penetration testing are arranged under their own scope. Your organization keeps the decisions and the acceptance of risk.
With leadership
Priorities, risks that are accepted and treated, and support in key decisions.
With your team
Policies, procedures, access, providers, secure development and continuity.
With clients and auditors
Security questionnaires, evidence, meetings and contractual requirements.
When an incident occurs
Initial guidance, coordination, decision support and communication. Afterwards, we review what happened and build in improvements based on the lessons learned.
Security strategy
With leadership, we move from the business and its risks to strategic security objectives, the capabilities required and the priorities for developing them. It is documented in a strategy that is approved, defended and reviewed. It is the method explained in our book.
Assessment with the TSM Maturity Model
A diagnosis of how well managed your security is, across the model's ten areas or the ones that matter most to you. You can choose a declarative assessment or an evidence-based one. See the two ways to assess.
Certification and compliance
Preparation for ISO/IEC 27001 or a SOC 2 report, with gap analysis, applicable policies, controls, evidence and internal audit. No one-size-fits-all models. What we build adapts to your organization and serves future client requirements. We have experience guiding organizations all the way to ISO/IEC 27001 certification.
Internal audits
We compare what is defined with what is actually applied, from technical to documentary analysis. We work as independent auditors, as part of your team or alongside external auditors, providing technical support, evidence analysis and translation of risks into operational terms.
Incident response and continuity
We start by identifying the business's critical assets. On that basis we build response plans with clear roles, analysis and containment mechanisms, internal and external communication protocols, and a record of every stage for recovery and lessons learned. We treat them as operational tools, kept current and put to the test.
Support implementing a SOC
We help you align the security operations center with your incident response plan and the risks that matter most, so that what it detects reaches whoever has to decide and turns into clear actions.
Penetration testing and hardening
We emulate the techniques of real attackers against websites, applications, APIs, networks, directory services and cloud environments, in black-box, gray-box or white-box mode. We also review segmentation, access, identities and secrets, logging and monitoring, and cloud exposure.
Executive summary in plain language, to decide and budget.
Technical report with evidence, proofs of concept and reproduction steps.
Risk matrix with severity, impact and estimated remediation effort.
Closing session and retest to verify the fixes work.
Your operations carry on as normal. We work in agreed windows and tell you right away if we find anything critical.
Secure software development
Security by design, as a quality attribute and not an add-on. It includes early requirements, architecture and technology advice, and security built into the whole lifecycle, aligned with ISO/IEC 27034 and the OWASP guides.
Security awareness
A risk-aware culture, adapted to the level and profile of each team. We work on phishing, credential use and information exposure, with participatory sessions and examples from your own context. The goal is to understand and prevent, not to scare.
TSM Maturity Model
It's not a checklist. It's a diagnosis.
You know security matters. What isn't always clear is how well managed it is, which risks are exposed and what to prioritize. The model turns that into an operational reading that shows what is happening, how well managed it is and what to do next.
10
assessment areas
4
maturity levels
279
observable criteria
Observable and verifiable
Each criterion is confirmed with real evidence, such as procedures, records, configurations and interviews. A control that exists but nobody reviews doesn't count the same as one that is consistent and traceable.
Proportionate to your context
A small business and a corporation don't need the same level. What is required is proportionate to size, risk and available resources.
Actionable
The result isn't just a number. It's a reading by area, with prioritized findings and concrete recommendations for moving up to the next level.
Level 3
Managed
The area is managed consistently and repeatably, with defined owners, clear criteria and sufficient evidence.
Levels are cumulative. To be at level 3, everything in level 2 has to be met. There are no shortcuts.
Ten information security areas
DGS
Security leadership and management
Governance, responsibilities, policy, risk management and reporting to leadership.
GA
Access management
Access provisioning, removal and changes, periodic reviews, MFA and privileges.
AT
Protection of devices and assets
Inventory, configuration, lifecycle, secure disposal and planned renewal.
PR
Network protection
Segmentation, firewall, secure remote access, Wi-Fi and internet exposure.
INF
Information protection
Classification, encryption, backup, restore testing and external sharing.
GP
Providers and third parties
Critical providers, contracts, security guarantees and third-party access.
GC
Change management
Approval, testing, rollback plans and control of urgent changes.
GV
Vulnerability management
Patching, scanning, technical assessments and exposure management.
DRI
Incident detection and response
Reporting channels, response, containment, closure and lessons learned.
CN
Business continuity
Impact analysis, continuity plans, defined RTO and RPO, and drills.
TSM Snapshot
Want an idea of where you stand?
A self-assessment of up to 40 questions, in about 15 minutes. At the end you see a traffic light for each of the ten areas and a profile that describes the overall pattern. It's automatic, requires no sign-up and your answers never leave your browser.
Opens in a new tab. It's indicative, not an assessment.
Two ways to assess, depending on what you need it for
Declarative assessment
To know where your organization stands
It's an internal-use assessment. Someone who knows operations well answers a questionnaire about the model's areas, with no documentation to prepare, and we interpret the answers against the model's criteria.
A quick reading of the current state.
Useful for deciding internal priorities.
All areas or only the ones that interest you most.
You receive a diagnostic report with level by area, findings and recommendations.
Evidence-based assessment
To demonstrate it to a third party
When a client, partner or auditor needs assurance, we assess each criterion through in-depth interviews and review of documents, records, configurations and concrete evidence, at headquarters and at other sites if applicable.
A verified result you can defend before third parties.
Interviews with staff and review of real evidence.
Report with impact scenarios.
You receive a full technical report and a signed letter you can present to third parties.
Transparency about our role. If we take part in your preparation, we say so and take it into account when defining the independence conditions of the assessment.
No overpromising. The assessment is not an accredited certification and does not guarantee the absence of risk. We say so from day one.
Assess what you need
The model applies to all ten areas or only to the ones that matter most today. For example, providers and continuity ahead of a key client's audit, or access and vulnerabilities after an incident.
The overall level is declared only when all ten areas are assessed. Otherwise, the result is presented as a partial assessment and always states the scope.
Example of a partial scope
Access management
Vulnerability management
Providers and third parties
Business continuity
Network protection
Incident detection and response
The result is presented as “TSM partial assessment, level N in the areas assessed.”
Free book
Framework for Defining a Security Strategy
A guide to go from the business and its risks to a strategy, and from the strategy to a security program that lasts over time. It focuses on how to reason, not on what to implement, and closes with a full case study.
Gonzalo Méndez, first edition, 2026. Creative Commons BY-ND 4.0 license.
A Discovery meeting of about 90 minutes, at no cost. It's not an audit. It's a conversation to understand your situation and decide together whether it makes sense to continue, and how.
Your business and its objectives
Technology, information and risk exposure
Current security practices
What you need to solve or demonstrate
Alternatives and next steps
Book a Discovery meeting
Tell us briefly what you'd like to solve. We'll reply to schedule the meeting.
