Offensive Cybersecurity
We are the adversary your defenses never expected.
NIS2, DORA and the EU AI Act each set testing expectations for the organizations they cover. IBEX35 companies and financial institutions rely on SilentForce to test their defenses against realistic attacks, with no subcontracting and tooling built in-house.
What We Do
Offensive Security Services
SilentForce approaches each engagement as a real adversary would, combining technical expertise with tooling built in-house to show how well your organization resists and responds to an attack.
Red Team Exercises
Objective-driven adversarial simulation that shows whether your teams detect and contain an intrusion. More than 120 intrusion exercises delivered for IBEX35 companies and critical infrastructure operators.
Learn moreAI Red Teaming
Adversarial testing of LLMs, AI agents and ML systems, scored with our ISVEX framework. The countdown shows the time left until EU AI Act high-risk obligations apply.
Learn morePenetration Testing
More than 400 audits across web, mobile, cloud, IoT and internal infrastructure, in black, gray or white box mode, with findings mapped to the NIS2 and DORA requirements they relate to.
Learn moreAd-hoc Research
Security research on devices, protocols and software for sectors such as IoT, defense and automotive, with responsible disclosure of the vulnerabilities it uncovers.
Learn moreChoosing an Engagement
Which Engagement Do I Need?
Each SilentForce service answers a different question about an organization's security. The table compares them on the points that usually decide which one comes first.
| Penetration Testing | Red Team | Attack Resilience ARGOS | AI Red Teaming | Attack Surface ATLAS + CAST | |
|---|---|---|---|---|---|
| Question it answers | Which vulnerabilities in a defined scope, from web and mobile to cloud, internal infrastructure and OT, can an attacker exploit? | Can the organization detect, respond to and contain a determined adversary across people, processes and technology? | Which attack techniques do the defensive tools and team detect, and how far does their maturity reach beyond detection, up to turning incidents into intelligence? | Can LLMs, AI agents and ML systems be led into unauthorized outcomes, and how exposed is each system to each attack vector? | What does the organization expose to the internet today, and which of those exposures can actually be exploited? |
| SOC / blue team told in advance | Agreed during scoping | No. The blue team is not aware of the exercise, which keeps it realistic. | No. Detection and response are measured as they would happen in a real incident. | Agreed during scoping | Agreed during scoping |
| Cadence | One-off or periodic. Each assessment covers a defined scope and can be repeated, for example as annual ISO 27001 evidence. | One exercise per engagement. Under DORA, designated financial entities run TLPT at least every three years. | Periodic or continuous. ARGOS supports continuous testing schedules, with scores comparable between iterations. | One-off or periodic. Assessments take from 2–3 to 8–12 weeks depending on scope; the Continuous AI Security program runs quarterly exercises. | Continuous. ATLAS monitors the external surface 24/7 and CAST tests new or changed assets as they appear. |
| Regulatory fit | NIS2, DORA / TIBER-EU, ENS, Cyber Resilience Act and ISO 27001. | DORA TLPT (Delegated Regulation (EU) 2025/1190) and TIBER-EU. | Not specified | EU AI Act Articles 9 and 15, and Article 55 for general-purpose models with systemic risk. NIS2 tracking in the continuous program. | NIS2, as ongoing evidence of the regular assessment of security measures. |
| Main deliverable | Executive summary and technical report with proof of concept, CVSS-based risk scoring and remediation guidance. | Executive and technical debrief reports, prioritized remediation roadmap, SOC tuning recommendations and TIBER-EU documentation. | Resilience score across four maturity levels, detection rates per MITRE ATT&CK technique and executive dashboards. | ISVEX-scored findings mapped to MITRE ATLAS and the OWASP Top 10 lists for LLM and agentic applications, with an EU AI Act evidence package. | ATLAS dashboard with assets and prioritized alerts, plus CAST findings with remediation guidance per finding. |
| Retest | Included. Free retest of every identified vulnerability after remediation. | Included. Post-remediation retest. | Repeat runs. Each iteration is scored against earlier results to show progress. | Included. Validation and retest is the final phase of the APEX Methodology. | Included. CAST retests each fix to confirm it is effective. |
A dash marks a point that depends on the engagement and is defined during scoping. Request a scoping call to define the right combination.
Regulatory Compliance
The Regulations Driving Offensive Testing
EU regulations set testing expectations for the organizations they cover, from the regular assessment of security controls under NIS2 to threat-led testing of designated financial entities under DORA. Which obligations apply, and from when, depends on the sector.
Essential and Important Entities
NIS2 requires essential and important entities to manage cyber risk through measures that include regular assessment of their security controls, with fines of up to 10M EUR or 2% of worldwide turnover. Spain has not yet transposed the directive. The draft law approved in January 2025 was never enacted, so Royal Decree-Law 12/2018 still applies.
SilentForce delivers penetration testing and adversarial simulation for energy, healthcare and telecommunications operators, so testing evidence is in place before the national law arrives.
Threat-Led Penetration Testing
DORA has applied since 17 January 2025. Financial entities designated by their competent authority must run Threat-Led Penetration Testing (TLPT) at least every three years under Delegated Regulation (EU) 2025/1190, in force since July 2025. TIBER-EU was revised in February 2025 to match those rules.
SilentForce runs Red Team exercises aligned with TIBER-EU for banking and financial services clients in Spain.
AI Systems Under Scrutiny
Rules for general-purpose AI models and transparency obligations already apply, and authorities have held enforcement powers since August 2026. After the Digital Omnibus (Regulation (EU) 2026/1744), requirements for high-risk systems listed in Annex III apply from 2 December 2027, and from 2 August 2028 for AI built into regulated products. Fines reach 35M EUR or 7% of worldwide turnover.
SilentForce was the first Spanish firm with a dedicated AI Red Teaming service, built on the proprietary APEX Methodology and the ISVEX scoring framework.
- 17 January 2025 Regulation (EU) 2022/2554 (DORA) Digital operational resilience requirements apply to EU financial entities.
- 8 July 2025 Delegated Regulation (EU) 2025/1190 Technical standards for Threat-Led Penetration Testing under DORA apply to designated financial entities.
- 2 August 2026 Regulation (EU) 2024/1689 (AI Act), Article 50 Transparency obligations apply and authorities can exercise their enforcement powers.
- 11 September 2026 Regulation (EU) 2024/2847 (CRA), Article 14 Manufacturers must report actively exploited vulnerabilities and severe incidents affecting products with digital elements.
- Today You Are Here , current position on the timeline
- 2 and 11 December 2027 AI Act, Annex III; dates set by the Digital Omnibus, Regulation (EU) 2026/1744. CRA, Regulation (EU) 2024/2847 Requirements for high-risk AI systems listed in Annex III apply from 2 December 2027. The CRA applies in full from 11 December 2027.
- 2 August 2028 AI Act, Annex I; dates set by the Digital Omnibus, Regulation (EU) 2026/1744 Requirements apply to high-risk AI built into products covered by the EU harmonization legislation in Annex I.
Proprietary Arsenal
Tools & Platforms
Platforms our clients can contract directly, and the internal tooling our operators use in every engagement. All of it is designed and maintained by the SilentForce team.
ATLAS
Continuous inventory and monitoring of everything the organization exposes on the internet, with early warning on new CVEs.
AI-Driven Perimeter TestingALASTOR
Recurring automated audits of exposed assets, with every run compared against the previous one.
BASARGOS
250+ tests mapped to MITRE ATT&CK that measure what your SIEM and EDR detect, block or miss.
Ransomware SimulationKHAOS
Controlled ransomware simulation with automatic recovery, measuring time to detection and containment.
DevSecOps ReviewALETHEIA
Evidence-based review of the chain from source code to production, with a quoted source for every verdict.
Tabletop ExercisesPROMETEO
Attack and defense tabletop exercises on a simulated version of your organization, refereed by SilentForce.
Why SilentForce
What Sets Us Apart
Red Team Experience
SilentForce has been operating for five years and is led by a founder with more than 15 years of offensive security experience. The team has delivered more than 120 intrusion exercises for IBEX35 companies, financial institutions and critical infrastructure operators.
Dedicated AI Red Teaming
A dedicated AI Red Teaming service built on the APEX Methodology (seven phases) and the ISVEX scoring framework (38 metrics). Both are backed by ongoing PhD research and mapped to MITRE ATLAS and the OWASP Top 10 lists for LLM and agentic applications.
100% In-House Operations
Every operator is a full-time SilentForce team member, and no part of an engagement is subcontracted to third parties.
Proprietary Arsenal
ATLAS, CAST, ALASTOR, ARGOS, KHAOS, ALETHEIA and PROMETEO are available to clients. CERBERUS, QUIMERA, TIFÓN, CARONTE, MAKHAI and PYTHIA support our own operations. All 13 tools are developed in-house.
Trusted By
Sectors We Protect
Procurement FAQ
Before You Contract an Engagement
Answers to the governance and purchasing questions that security and procurement teams usually raise before the first scoping call.
Other questions: info@silentforce.io
Who carries out the work, and is any of it subcontracted?
Every engagement is delivered by full-time SilentForce operators. SilentForce does not subcontract any part of its engagements, and the tooling the operators use is developed in-house.
What track record does SilentForce have?
SilentForce has been operating for five years and is led by a founder with more than 15 years of offensive security experience. The team has completed more than 400 audits and more than 120 intrusion exercises for over 40 clients, including IBEX35 companies and financial institutions.
Which service answers DORA, NIS2 or the EU AI Act?
For Threat-Led Penetration Testing (TLPT) under DORA, SilentForce runs Red Team exercises aligned with TIBER-EU and Delegated Regulation (EU) 2025/1190. Penetration Testing provides the regular assessment of security controls that NIS2 expects from essential and important entities. AI Red Teaming documents adversarial testing of AI models and systems as evidence for the EU AI Act.
Is our SOC told about a Red Team exercise?
The Blue Team is not told that the exercise is taking place, so that detection and response are measured under realistic conditions. The objectives of the exercise are agreed with the client before it starts.
Are vulnerabilities retested after we fix them?
Yes. Penetration Testing includes retesting of every identified vulnerability after remediation at no additional cost. Red Team exercises include a post-remediation retest, and AI Red Teaming ends with a validation and retest phase that repeats the attack vectors that succeeded.
What do we receive at the end of an engagement?
An executive report for leadership and a technical report for the teams that will apply the fixes, with remediation priorities. Penetration Testing findings are scored with CVSS, and AI Red Teaming findings with ISVEX. Each service page lists its specific deliverables.
How do we start?
Write to info@silentforce.io with a short description of what you want to test and the regulatory requirement behind the request, if there is one. SilentForce then arranges a scoping call and proposes an approach tailored to your organization.
Ready to Test Your Defenses?
Let's start with a conversation.
Tell us what you need to test and which regulation, if any, is behind the request. SilentForce will propose an approach that fits your organization and the NIS2, DORA or EU AI Act requirements that apply to it.
Contact Us