Spain security reports

A

Actyus | Fintech venture capital

actyus.com

63

The website demonstrates a moderate overall security posture with no critical issues but multiple high-severity vulnerabilities predominantly in governance, compliance, and configuration areas. Key deficiencies exist in GDPR compliance, including missing privacy and cookie policies and absence of a consent banner, exposing the organization to regulatory and reputational risks. Security headers are inadequately configured, increasing exposure to common web-based attacks such as clickjacking and cross-site scripting. The lack of a formal information security framework, incident response procedures, and security policy documentation indicates immature cybersecurity governance, which could delay breach detection and response. Email security and DNS health are relatively strong, though improvements in DMARC enforcement and DNSSEC could further reduce phishing and spoofing risks. SSL/TLS configuration issues, including weak key length and imminent certificate expiration, present risks to secure communications and customer trust. Network security posture is solid, providing a stable foundation for other improvements. Addressing these issues promptly will reduce regulatory exposure, enhance customer trust, and strengthen overall risk management.

B

Balearic Marine Cluster

balearicmarinecluster.com

61

The website’s security posture reveals significant gaps in foundational security controls and regulatory compliance, posing risks to both business operations and customer trust. While there are no critical vulnerabilities, multiple high and medium severity issues indicate a lack of essential security headers, incomplete GDPR compliance, and absence of key information security policies aligned with NIS2 requirements. The missing security headers expose the site to common web-based attacks like clickjacking, content injection, and cross-site scripting. GDPR non-compliance, including the absence of a privacy policy and cookie consent, risks regulatory penalties and reputational damage. The lack of incident response, security policies, and vulnerability disclosure procedures undermines the organization’s ability to manage and mitigate security incidents effectively. Exposure of high-risk services such as FTP further increases attack surface and potential data breaches. Although email security and DNS health are relatively strong, SSL/TLS and network security require immediate attention to prevent service disruptions and data interception. Overall, addressing these deficiencies is critical to protect customer data, maintain regulatory compliance, and safeguard business continuity.

B

Black Bull Group

blackbull-group.com

60

The website's security posture reveals significant gaps that expose the business to potential cyber risks and regulatory non-compliance. While there are no critical vulnerabilities, several high and medium-level issues, particularly in security headers, GDPR compliance, and network security, present serious concerns. Missing essential HTTP security headers increases exposure to web-based attacks such as clickjacking, content injection, and cross-site scripting. The absence of privacy and cookie policies, alongside missing cookie consent mechanisms, risks violating data protection regulations like GDPR, potentially resulting in legal penalties and reputational damage. Additionally, the lack of incident response procedures and vulnerability disclosure policies hampers the organization's ability to effectively manage and recover from security incidents. The exposure of high-risk services like FTP further elevates the threat landscape. Overall, immediate remediation is essential to enhance security posture, protect customer data, and ensure regulatory compliance to safeguard business continuity and trust.

This website has 2 critical security issue(s) requiring immediate attention. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

This website has 1 critical security issue(s) requiring immediate attention. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

F

Façonnable

faconnable.com

80

The website demonstrates a generally solid security posture with no critical vulnerabilities detected and strong scores in email and network security. However, significant gaps exist in compliance with GDPR and NIS2 regulations, particularly around cookie consent, incident response, and security contact information, which expose the business to legal and operational risks. Security headers are partially configured but lack important protections against common web attacks, potentially increasing exposure to client-side threats. Mixed content and DNS security weaknesses also undermine the integrity and confidentiality of user interactions. While SSL/TLS and network configurations are mostly robust, improvements are needed to fully secure data transmission. Addressing these issues will not only enhance security but also improve regulatory compliance and customer trust. Prioritizing GDPR and NIS2 compliance will mitigate legal risks and strengthen incident readiness. Overall, the site is secure but requires targeted improvements to protect business continuity and reputation effectively.

S

SAFINCO

safinco.com

60

The website's overall security posture reveals significant gaps, particularly in governance, privacy compliance, and essential security headers, exposing the business to regulatory risks and potential cyber threats. While there are no critical vulnerabilities, the presence of 11 high and 9 medium severity issues highlights urgent areas for remediation. Notably, missing privacy policies and consent mechanisms put the organization at risk of GDPR non-compliance, which could lead to costly fines and reputational damage. The absence of a formal information security framework, incident response procedures, and security policies under NIS2 requirements further exposes the business to operational disruptions and regulatory scrutiny. Security headers are inadequately configured, increasing exposure to web-based attacks like clickjacking and cross-site scripting. Additionally, the exposure of an FTP service represents a high-risk attack vector that could enable unauthorized access or data leakage. Overall, this assessment underscores the need for immediate governance improvements, privacy compliance actions, and technical hardening to safeguard the business and its customers.