Top 10 MSSPs in Spain in 2026

Choosing among the top MSSPs in Spain is a bigger decision in 2026 than it was a year ago. The law that will transpose the EU’s NIS2 Directive is still a government draft that never reached Parliament, and the snap general election called for November 29, 2026 will delay it further. Almost every provider advertises a “24/7 security operations center (SOC),” yet the label can describe a certified center in Madrid, a facility abroad, or a partner’s SOC sold under another brand.

A Managed Security Service Provider (MSSP) is a third-party company that runs an organization’s security monitoring, threat detection, and incident response on a continuous basis, usually from its own SOC. In Spain, a credible MSSP also maps that service to the National Security Framework (ENS), the incoming NIS2 regime, the EU’s Digital Operational Resilience Act (DORA), and the General Data Protection Regulation (GDPR) as enforced by the Spanish Data Protection Agency (AEPD).

This guide profiles 10 MSSPs operating in Spain in 2026, listed in no particular order; it is not a ranking. Providers were selected editorially for public evidence of their own SOC or managed detection and response (MDR) delivery in Spain, credentials a buyer can check on a register or certificate, and a deliberate mix of sizes and specialties.

Why Spain’s MSSP Market Matters in 2026

Spain’s incident curve is still climbing. INCIBE, Spain’s National Cybersecurity Institute, handled 122,223 incidents in 2025, 26% more than in 2024, including 401 at essential and important operators, and INCIBE-CERT flagged 237,028 vulnerable systems. Recent breaches at Iberia in November 2025 and Endesa Energía in January 2026 exposed customer data through a supplier’s systems and a commercial platform.

Three forces are pushing Spanish organizations toward managed security:

• Regulation in limbo: The Council of Ministers approved the NIS2 transposition only as a preliminary draft (anteproyecto) on January 14, 2025, and it was never sent to Parliament. The European Commission referred Spain to the EU Court of Justice on July 8, 2026, and with the Cortes dissolved for the November 29 election, the next government will have to take the draft forward. Meanwhile, the ENS binds public bodies and their technology suppliers, DORA has applied to financial entities since January 17, 2025, and the GDPR requires breach notification to the AEPD within 72 hours.
• A national SOC network with entry rules: The National SOC Network (RNS), run by CCN-CERT, the computer emergency response team (CERT) of the National Cryptologic Center (CCN), connects more than 300 public bodies and providers. Members must operate an ENS-certified SOC and share intelligence through CCN tools, and the CCN grades contributors up to a Gold tier.
• Talent shortage: An INCIBE talent study projected demand for more than 83,000 cybersecurity professionals in Spain by 2024, and Catalonia alone faces a talent gap Indra Group estimated at 13,500 specialists in April 2026.

Quick Reference Table

Here are the 10 providers in this guide at a glance, in no particular order.

The Top 10 Managed Security Service Providers in Spain in 2026

1. Telefónica Tech

Website: telefonicatech.com · Parent: Telefónica · HQ: Madrid · Scale: 2,500+ cybersecurity operations professionals (company-stated, July 2024)

Telefónica Tech is the digital business unit of Spain’s largest telecommunications group, and its managed security sits inside NextDefense, a portfolio spanning threat detection and response, identity and vulnerability management, offensive security, and network, data, and cloud security. Its cyber intelligence services run 24/7 from Digital Operations Centers in Madrid and Colombia, which coordinate a global network of 11 SOCs (company-stated, 2023).

Two things set it apart in Spain. The same group that runs many organizations’ connectivity can also run their security operations, and Telefónica Tech monitors OT in energy, healthcare, and transport, down to electromedical equipment in hospitals. Analyst recognition includes Avasant, which named it a Leader in cybersecurity services for the third consecutive year in 2024, and IDC MarketScape, which placed it among the Leaders in its European managed security services assessment in January 2022.

Verifiable credentials: The group-level Telefonica CSIRT is a Listed team in the Trusted Introducer directory, re-listed in August 2023. Group listings do not certify individual service lines, so request the ENS certificate and category for the specific SOC service being bought.

For organizations that want one national-scale provider across network, cloud, and security operations, Telefónica Tech is the natural first call.

Core Services: NextDefense MDR, managed SOC, OT security monitoring, identity and vulnerability management, offensive security, cloud security · Ideal for: Large enterprises and public bodies that want security operations bundled with network and cloud services from one national provider.

2. IndraMind Cybersecurity (Indra Group)

Website: indramindcybersecurity.com · Parent: Indra Group (2025 revenue €5,457 million) · Scale: 2,000+ cybersecurity specialists (company-stated)

IndraMind Cybersecurity is the cybersecurity unit of Indra Group, Spain’s flagship defense and technology group, which now gathers its sovereign AI, cybersecurity, and cyber defense capabilities under the IndraMind banner. The unit describes itself as the leader in Spain and Portugal by revenue and talent, and it carries forward the i-CSOC operations center from which Indra has delivered 24/7 protection to companies and public institutions.

Its newest asset is regional. In April 2026, IndraMind opened an Innovation and Talent Center in Barcelona built around a next-generation SOC running its Smart MDR AI-SOC Agent, serving public and private organizations across IT, Internet of Things (IoT), and OT with infrastructure, data, and support kept in Catalonia. That sovereignty pitch, backed by defense heritage, is its clearest differentiator with Spanish public administrations and critical operators.

Verifiable credentials: IndraMind CERT is a Listed team in the Trusted Introducer directory, re-listed in August 2024 with 24/7 service, and a FIRST (Forum of Incident Response and Security Teams) Full Member since September 19, 2018. Request the ENS certificate, CCN-STIC 896 conformity, and National SOC Network status for the specific SOC that will serve the account.

For buyers who weigh technological sovereignty as heavily as capability, IndraMind is the sovereignty-first option.

Core Services: Managed SOC and MDR (Smart MDR AI-SOC Agent), cyber defense, OT and IoT security, digital identity and trust services · Ideal for: Public administrations, defense, and critical infrastructure operators that prioritize Spanish technological sovereignty.

3. S21sec (Thales)

Website: s21sec.com · Founded: 2000 · Owner: Thales (since 2022) · SOCs: Madrid and Porto

S21sec is one of Spain’s original security pure-plays, and its CERT dates to January 2000. Thales agreed to buy it in 2022, together with Luxembourg’s Excellium, for an enterprise value of €120 million; at signing the two firms had 549 employees and €59 million in combined 2021 sales, with three quarters of staff in nine centers across Spain and Portugal.

Today S21sec runs an Iberian model: a Madrid SOC working alongside a second center in Porto, heavy automation in triage, a dedicated research and intelligence team, and a DFIR unit that acts as a rapid-response squad when incidents escalate. The company describes its Madrid facility as the first private SOC in Spain.

Verifiable credentials: S21sec CERT has been a Trusted Introducer Accredited team since September 19, 2011, with 24/7 business hours, and a FIRST Full Member since July 1, 2011. Its host organization is Thales S21sec España.

More than 25 years of Spanish track record plus the backing of a European defense group make S21sec a strong fit for buyers who want both.

Core Services: Managed SOC, MDR, DFIR, threat intelligence, consulting and audit · Ideal for: Enterprises and regulated organizations that want a veteran Spanish pure-play with European defense-group backing.

4. S2 Grupo

Website: s2grupo.es · Founded: 2004 · HQ: Valencia · Scale: 700+ professionals; €42 million revenue in 2023 (company-reported)

S2 Grupo calls itself the largest cybersecurity company with 100% Spanish capital, and it has built its business around critical infrastructure. It runs four SOCs in Valencia, Madrid, Mexico City, and Bogotá; the Valencia center covers more than 2,500 square meters and operates 24/7, with Madrid as its main backup. More than 300 people work in its CERT, and its iSOC monitors industrial facilities on the company’s own operational intelligence platform.

Its public-sector depth is structural. S2 Grupo was a founding member of the National SOC Network alongside Accenture, Entelgy Innotec, and Sothis, lists IBEX-35 companies, ministries, and CCN-CERT among its clients, and in November 2025 signed a memorandum of understanding with Indra Group to develop advanced cyber defense capabilities.

Verifiable credentials: S2 Grupo CERT has been a Trusted Introducer Accredited team since April 19, 2016, and a FIRST Full Member since February 27, 2015, with a constituency covering Spain and Colombia.

For operators of energy, water, transport, and health infrastructure that need IT and OT watched by one Spanish team, S2 Grupo is built for that brief.

Core Services: Managed SOC and CERT services, industrial cybersecurity (iSOC), DFIR, rapid intervention for critical infrastructure, cyber intelligence · Ideal for: Critical infrastructure, industrial, and public sector organizations that need IT and OT covered by a Spanish-owned provider.

5. Accenture (Innotec Security)

Website: accenture.com · Spanish MSS arm: Innotec Security (founded 2002, acquired November 2, 2023) · HQ: Madrid · Scale: 500 Innotec professionals within a 20,000-strong global security workforce

Accenture’s Spanish managed security capability runs largely through Innotec Security, the Madrid company founded in 2002 that Accenture acquired from Entelgy Group on November 2, 2023. The deal added 500 cybersecurity professionals in Madrid, Barcelona, Seville, and the Basque Country, and Accenture said it made Accenture Security one of the top managed security services players in Spain.

Innotec’s services span threat simulation, detection, response and incident management, cyber intelligence, and infrastructure and application security for clients in finance, energy, logistics, healthcare, transport, and government. Accenture was also a founding member of the National SOC Network, which put its Spanish SOC inside the public sector intelligence-sharing community from the start.

Verifiable credentials: Innotec Security has been a FIRST Full Member since April 26, 2016. Its Trusted Introducer accreditation, held since October 14, 2016, was suspended on April 25, 2026, so ask Accenture about its current status.

For large enterprises that want managed security wired into a wider transformation program, Accenture pairs Spanish SOC depth with a global delivery network.

Core Services: Managed security services, detection and response, incident management, cyber intelligence, threat simulation, security consulting · Ideal for: Large enterprises and public bodies running security inside broader technology transformation programs.

6. Deloitte (EMEA Cybersphere Center)

Website: deloitte.com/es · Delivery center: EMEA Cybersphere Center (ECC), Madrid · Scale: 400+ cyber operations professionals at the ECC (Deloitte center dossier)

Deloitte runs managed security for Europe, the Middle East, and Africa from the EMEA Cybersphere Center in Madrid, a delivery center offering 24/7 operations with an international pool of specialists. The firm’s own center dossier lists more than 400 cyber operations professionals working alongside strategy and consulting teams, and Deloitte highlights IoT and industrial control systems among its specialist capabilities.

The advantage for Spanish buyers is proximity to an EMEA-scale operation: the team that monitors a Spanish client also serves multinationals across the region, inside a firm whose audit, risk, and regulatory practices are often already engaged on DORA and NIS2 work.

Verifiable credentials: The center’s response team, listed as DELOITTE EDC (official name DELOITTE ECC), has been a Trusted Introducer Accredited team since July 18, 2023, hosted by Deloitte CyberSOC EMEA Center, and a FIRST Full Member since May 1, 2019.

For regulated multinationals that want managed security delivered next to audit-grade governance, Deloitte’s Madrid center is the Big Four option with a verifiable incident response pedigree.

Core Services: Managed security services, MDR and threat hunting, cyber intelligence, incident response, OT and IoT security, cloud security · Ideal for: Regulated multinationals and financial institutions that want EMEA-scale managed security with Big Four governance.

7. BeDisruptive

Website: bedisruptive.com · Founded: 2017 · HQ: Madrid · SOCs: Madrid, Rome, and Panama City

BeDisruptive describes itself as a boutique technology company specializing in cybersecurity, and it has grown fast since its 2017 founding. When it doubled its Madrid office space in the Torre de Cristal on the Paseo de la Castellana, the new 1,334-square-meter facility housed more than 200 employees, and the company was already running SOCs in Madrid, Rome, and Panama City. Its BeSOC centers operate on a 24/7 model that extends to OT, industrial IoT, and network operations.

BeDisruptive has also invested in community credentials: it joined the National SOC Network and the CSIRT.es forum, and announced Gold status in the RNS in late 2023.

Verifiable credentials: BeSOC Madrid appears as a CSIRT.es member. Its Trusted Introducer accreditation, held since March 1, 2023, was suspended on June 12, 2026, so ask about reinstatement and confirm the current tier on the RNS portal.

For mid-size and large organizations that want a fast-growing Spanish specialist with OT and industrial coverage, BeDisruptive is the challenger to evaluate.

Core Services: Managed SOC (BeSOC), threat detection and response, OT and industrial IoT monitoring, incident containment, security consulting · Ideal for: Mid-size and large organizations, including industrial operators, that want a Spanish pure-play with OT coverage and National SOC Network membership.

8. Ackcent

Website: ackcent.com · Founded: 2014 · HQ: Barcelona · Scale: about 60 employees (2025 registry data)

Ackcent is the Barcelona specialist on this list. Incorporated in August 2014 and employing about 60 people in 2025, it pairs 24/7 MDR and security operations with expert-led strategic assessments, exposure assessments, and exercises, delivered by teams in Barcelona, Madrid, and Mexico from its own SOC.

Cloud is a recurring theme: the company highlights 24/7 monitoring with continuous vulnerability intelligence and managed cloud security for public and private cloud environments. Its listed specialties also cover penetration testing, security audits, and red and blue team work, so detection and offensive testing can sit with one accountable team.

Verifiable credentials: No Trusted Introducer, FIRST, CSIRT.es, or RNS listing was confirmed for this guide as of October 2026. Request the ENS certificate and category, plus SOC 2 or ISO/IEC 27001 attestations covering the MDR service.

For mid-market and cloud-first companies that want a hands-on Barcelona team running MDR alongside offensive testing, Ackcent is the boutique option.

Core Services: 24/7 MDR and SOC operations, managed cloud security, vulnerability intelligence, penetration testing and audits, red and blue team exercises · Ideal for: Mid-market and cloud-first organizations, especially in Catalonia, that want a specialist partner close to home.

9. Babel Group

Website: babelgroup.com · Founded: 2003 · HQ: Las Rozas de Madrid · Scale: 3,300 professionals in nine countries at the start of 2025 (company-stated)

Babel is a Spanish technology multinational whose cybersecurity business took its current shape when it integrated Málaga TechPark specialist Ingenia in July 2021. The group then made Málaga the global hub for its managed cybersecurity services, with more than 200 specialists there by July 2022 and a plan to reach 700. Group revenue reached €180 million in 2023.

Its security operations run as an eSOC/CSIRT with IT and OT coverage distributed between Spain and Chile, supported by blue team, red team, DFIR, threat hunting, cyber intelligence, secure development, cloud security, and awareness services. Babel also sells Security Infrastructure as a Service, taking day-to-day operation of network and security equipment off internal IT teams.

Verifiable credentials: AENOR certifies Babel’s managed security services, including SOC services, 24/7 availability and security monitoring, incident management and response, cyber surveillance, and industrial cybersecurity, as conformant with the ENS at High category; the certificate (ENS-2021/0024) was reissued on November 14, 2025 and is valid until June 5, 2027.

For public bodies and large enterprises that want ENS High-certified managed security from a Spanish-founded IT services group, Babel is a strong option.

Core Services: Managed SOC (eSOC/CSIRT), 24/7 monitoring and incident response, cyber surveillance, industrial cybersecurity, red team and penetration testing, Security Infrastructure as a Service · Ideal for: Public administrations and enterprises, especially in Andalusia, that want ENS High-certified SOC services alongside wider IT services.

10. Advens

Website: advens.com/es · Group HQ: France · In Spain since: February 2023 (Madrid and Barcelona) · Spanish entity: Advens Cybersecurity S.L., about 35 employees (2025 registry data)

Advens is a French cybersecurity pure-play that entered Spain in February 2023, opening offices in Madrid and Barcelona. At the time the group had more than 450 cybersecurity employees across France, Canada, and Asia-Pacific, with clients including Alcampo, BNP Paribas, L’Occitane, and Decathlon. Its Spanish subsidiary, incorporated in March 2023, employed about 35 people in 2025.

The flagship service is mySOC, which Advens describes as its most requested offering, providing monitoring, detection, and incident response across on-premises and cloud environments, alongside CERT services and a portfolio that runs from compliance to managed detection.

Verifiable credentials: Advens Cybersecurity holds an ENS High certificate (ES26/00000141, valid until February 6, 2028) covering offensive security, defensive security, governance, risk, and compliance (GRC), and the mySOC service as delivered by its Iberian staff.

For organizations that want a European cybersecurity pure-play with a local Iberian team, Advens is the cross-border option.

Core Services: mySOC managed detection and response, CERT and incident response, offensive security and red team, cyber surveillance, GRC consulting · Ideal for: Mid-size and large organizations, including groups with operations in France and Spain, that want a European pure-play with local delivery.

How to Choose an MSSP in Spain

The 10 providers differ in scale, sector depth, and how much of their delivery happens on Spanish soil. Spain has no single MSSP license, so start with the credentials a buyer can check, then test fit.

• Verify before shortlisting: Ask for the certificates and exact team names behind each claim and check them against the issuer’s register. A credential the register does not show deserves a direct question.
• Plan for NIS2 now: NIS2 lists managed security service providers among its high-criticality sectors, so medium and large MSSPs will themselves become regulated once Spain’s law passes. Ask how the provider will support the draft law’s 24-hour early warning, 72-hour notification, and one-month final report.
• Map the service to your regulators: Public bodies and their suppliers need ENS alignment, financial entities need DORA third-party and major-incident processes, and anyone handling personal data needs a 72-hour AEPD notification workflow. Ask for the audit-ready evidence the service produces.
• Ask where the SOC is and who runs it: Confirm where analysts sit, whether Spanish or EU data residency is contractual, and whether the SOC is in-house or a partner’s sold under another brand.
• Test supplier and Dark Web coverage: The Iberia and Endesa incidents ran through a supplier and a customer-facing platform, so ask how the provider monitors third-party exposure, leaked credentials, and Dark Web activity about your brand.
• Match the provider to your gap: National scale points to Telefónica Tech (#1); sovereignty and defense to IndraMind (#2); a veteran pure-play to S21sec (#3); IT and OT critical infrastructure to S2 Grupo (#4); transformation programs to Accenture (#5); multinational governance to Deloitte (#6); a fast-growing specialist with OT coverage to BeDisruptive (#7); cloud-first mid-market MDR to Ackcent (#8); ENS High-certified SOC services alongside IT services to Babel (#9); and a European pure-play with local delivery to Advens (#10).

Frequently Asked Questions

What is the difference between an MSSP, MDR, and SOC-as-a-service?

An MSSP is the umbrella term for a provider that runs security operations for clients. SOC-as-a-service supplies the monitoring center and analysts, while MDR adds threat hunting and hands-on containment. Most providers in Spain sell all three under different names, so compare the response actions written into each contract before comparing prices.

Does NIS2 apply to MSSPs in Spain?

Yes. NIS2 lists managed security service providers in its high-criticality sector for ICT service management, so medium and large MSSPs operating in Spain will become regulated entities once the Cybersecurity Coordination and Governance Law is enacted. Until then, Royal Decree-Law 12/2018 still applies, and MSSPs serving the public sector must already meet the ENS.

How quickly must a data breach be reported in Spain?

Under the GDPR, organizations must notify the AEPD within 72 hours of becoming aware of a personal data breach that risks individuals’ rights, and must tell affected people when the risk is high. Financial entities also follow DORA’s major-incident reporting, and Spain’s draft NIS2 law adds a 24-hour early warning for essential and important entities.

Does security data have to stay in Spain?

Not always. The GDPR allows transfers within the EU and to countries covered by an adequacy decision or other appropriate safeguards, but some public-sector and critical infrastructure tenders require Spanish or EU data residency. AWS, Microsoft Azure, and Google Cloud all run Spanish regions, so residency for logs and case data is achievable and belongs in the contract.

How much does an MSSP cost in Spain?

Pricing depends on the number of monitored assets, log volume, the response actions included, and the compliance reporting required. SME-focused MDR is usually priced per endpoint or user, while enterprise SOC contracts are scoped individually. Request quotes from at least three providers against the same asset inventory and service levels to compare like for like.

Do I still need an MSSP if I have an in-house security team?

Often, yes. Few Spanish organizations can staff a 24/7 SOC on their own, and INCIBE has projected national demand for more than 83,000 cybersecurity professionals by 2024. A co-managed model is common: the MSSP covers round-the-clock monitoring and first response, while the internal team keeps ownership of architecture, risk decisions, and business context.

SOCRadar provides extended threat intelligence covering threat actors targeting Spain, on Dark Web forums, Telegram channels, and data leak sites. Our Dark Web Monitoring capabilities help detect early exposure of organizational data before that exposure escalates into a breach. Request a demo or run a free Dark Web scan to understand your current exposure baseline.