Cybersecurity for SMEs · Málaga and the Costa del Sol
Can someone send emails in your company's name?
We check using public data only, without touching anything without your permission, and give you a clear report with prioritised actions. Defined scope and a fixed quote after diagnosis.
Check my domain See services and terms
- Public data only
- Nothing without signed authorisation
- No monthly fees or long-term contracts
Areas of work
Specialists for specific projects, with a fixed scope
Technical diagnosis, documented in writing. You decide what gets fixed and who fixes it.
The costliest fraud doesn't come in through a virus. It arrives in an email that looks like it's from you.
A client or supplier receives an email with your exact address, your logo and a perfectly ordinary tone: “We've changed banks; from now on, please pay into this account.” They pay. And you don't find out until someone chases the payment. Many companies haven't enabled the public setting that tells the rest of the world: “if an email uses my name and doesn't come from my servers, reject it.”
Invoices with changed bank details
The company that pays loses the money and still owes the real invoice, as the Guardia Civil has explained in cases published in 2026.
Your name in someone else's hands
The fake email lands in your client's inbox, not yours. That's why many impersonated companies never even notice.
Legitimate emails going to spam
A poor configuration also sends your own quotes and invoices straight to the spam folder.
Sources: INCIBE, Cybersecurity Report 2025 (122,223 incidents handled, +26%); Guardia Civil, 2026 cases reported by Diario HOY and Ideal.
How we work
First, permission and scope in writing. Then the diagnosis and the action plan.
Public data
We check what your domain publishes on the internet: email DNS records (SPF, DKIM, DMARC), DNS, the website certificate and already known data leaks. The same information anyone can see. We don't scan or test your systems.
Authorisation
If the work needs more than public data, a representative of your company signs off on it first. No signature, no work.
Traffic-light report
Red, amber and green, in plain language, with a list of actions in order of priority.
Action plan
We walk you through it in a 30-minute meeting. The audit delivers the diagnosis and the action plan. Fixes are not included: if you want us to apply them or coordinate them with your IT provider, they are quoted in writing and invoiced separately.
“We don't replace your IT provider. They're the family doctor; we're the specialist you call in for a specific job, with a fixed scope.”
Fixed-price services
Scope fixed in writing before we start. Payment upfront, with an invoice. Fixed quote after diagnosis.
Basic Audit
Fixed quote after diagnosis
- 1 domain: email protection (SPF, DKIM, DMARC) and public DNS
- PDF report with traffic-light rating and prioritised actions
- 30-minute meeting
- Fixes not included: quoted and invoiced separately
Full Audit
Fixed quote after diagnosis
- Up to 3 domains
- Everything in Basic + website certificate and headers
- Corporate email addresses exposed in known data leaks
- Fixes not included: quoted and invoiced separately
Preventive digital intelligence
Fixed quote after diagnosis
Brand and email impersonation, data leaks, public exposure and insider leak prevention.
See serviceCloud cost audit
Fixed quote after diagnosis
Forgotten or oversized resources and estimated savings in euros, using read-only access.
See serviceAutomation
Fixed quote after diagnosis
Invoices, emails, spreadsheets and recurring reports. 15 days of support for adjustments.
See packagesIncident response
Fixed quote after diagnosis
Spoofed or compromised email, fraudulent invoice or lost account access. Minimum 1 hour.
See termsCloud migration
Fixed quote after diagnosis
Written, phased plan with a rollback plan in place, execution only with signed authorisation, and full handover documentation.
See serviceData engineering
Fixed quote after diagnosis
Source integration, automated data loads, data quality checks and a documented data warehouse.
See serviceAudits delivered within 3–5 working days of payment and signed authorisation. Any later review or new check is booked as a new service. All services and terms: services · order.
Frequently asked questions
Common questions before ordering.
Will you access my systems?
No. The public audit only looks at information your domain already publishes on the internet. Anything beyond that requires your signed authorisation, and without it we don't do it.
How did you spot a misconfiguration on my domain if we've never met?
Email DNS records (SPF, DKIM and DMARC) are public by design: mail servers all over the world check them to confirm whether a message really comes from you. Anyone can see them, including people with bad intentions.
I already have someone who looks after our IT. Why would I need you?
For specialist work that isn't part of their day-to-day. We hand them (or you) the diagnosis and the action plan so they can implement it. If you'd rather we do the work ourselves, the fixes are quoted in writing and invoiced separately. We don't provide maintenance and we're not looking to replace them.
What exactly do I get?
A PDF report with a traffic-light rating (red, amber, green) and prioritised actions, plus a 30-minute meeting to walk you through it. Fixes are not included: if you want them, they are quoted in writing and invoiced separately.
How long does it take?
3 to 5 working days from payment and receipt of the signed authorisation.
Why do I have to pay upfront?
Because we work to a fixed price and scope, with no surprises. You can pay by card through Stripe (invoice issued automatically) or by bank transfer. For large automation projects, you can pay 50% upfront and 50% before delivery.
How is the price set?
Fixed quote after diagnosis: we look at your case first and then send you a fixed written quote, with applicable taxes shown separately.
Can you guarantee I'll never be scammed?
No, and be wary of anyone who promises that. Shutting down spoofing of your domain makes fraud much harder, and the report tells you what else to watch for, such as confirming any change of bank details by phone.
What if I want another review later, or someone changes the configuration?
We treat it as a new service, with its own scope and fixed price. We can't be held responsible for changes that you, your IT provider or third parties make to the systems after delivery. That's why everything we deliver is fully documented.
What should I do if I've already paid a fake invoice?
Call your bank immediately, gather the emails and report it to the Policía Nacional or the Guardia Civil as soon as possible. You can also call INCIBE's 017 helpline. If personal data is affected, consider notifying the AEPD (within 72 hours at most). We can help you with containment (incident response, fixed quote after diagnosis).
What is a passive cybersecurity audit?
It is a review of what your company already exposes publicly: DNS, email authentication (SPF, DKIM, DMARC), web certificates and known data leaks. We do not log into or scan your internal systems. You receive a prioritised report explaining each risk in business language and what to correct first.
How much does an email and domain audit cost?
Every engagement receives a fixed quote after a short diagnosis of your domains and needs. The Basic audit covers one domain, the Complete audit up to three domains plus web and leak exposure, and the Pack adds a simple automation. Scope and price are confirmed in writing before any work begins.
Can criminals send emails pretending to be my company?
Yes, if your domain lacks a DMARC policy that tells receivers to reject or quarantine unauthenticated mail. Without it, anyone can send messages that appear to come from your address, for example fake invoices with changed bank details. The audit checks this and explains the exact records to publish.
Sources: INCIBE 017 · AEPD, personal data breaches.
Who's behind it
I'm Fabio Guimaraes, an engineer and independent specialist. vrtxcloud is me: when you talk to me, you're talking to the person who does the work and signs the report.
My work is reviewing what anyone can see about a company online, cutting cloud overspend and automating repetitive tasks. Always with the same rule: permission first, plain language, fixed scope and price.
I work remotely with SMEs in Málaga and on the Costa del Sol, and alongside IT providers and business advisory firms: I add to their work, I don't replace it.
I don't publish case studies or testimonials yet: when I do, they will be real and published with written permission. In the meantime, you can see the sample report, which uses dummy data.
Protect your company email
Leave your domain and how to reach you, and we'll explain the scope and fixed price of the service that fits your needs.