S21sec
Thales-owned Iberian managed security provider running SOCs in Madrid and Porto, with an accredited CERT, MDR, DFIR and threat intelligence.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
S21sec was founded in 2000 in San Sebastián and was one of Spain’s first dedicated cybersecurity firms. It became part of Maxive Cybersecurity, backed by Sonae, alongside Luxembourg’s Excellium. Thales agreed to buy both companies in May 2022, reportedly for an enterprise value of about EUR 120 million, and closed the deal in October 2022. At closing, Thales said S21sec had about 400 employees across nine centres in Spain and Portugal. The business now operates as Thales S21sec, using the s21sec.com domain and the legal entity Thales S21sec España S.A.U. Its Madrid office is on Calle Emilio Vargas.
Its services include a managed SOC and MDR, digital forensics and incident response, threat intelligence, and consulting and audit, including OT security, for which it runs the NextSecure OT event in Bilbao. Its Madrid SOC, described as Spain’s first private SOC, works with a second SOC in Porto and is part of Thales’s global SOC network. S21sec CERT has been accredited by Trusted Introducer and has been a FIRST full member since 2011.
S21sec publishes threat research under the Thales brand, including the annual Threat Landscape and sector reports such as one on aviation (2025). Most current market coverage treats it as Thales’s Iberian cyber services unit rather than a standalone company.
Innovation Matrix Assessment
It keeps publishing research and running OT events, but no notable new service or platform launches since the Thales integration were found.
Two Iberian SOCs, an accredited CERT, DFIR and OT consulting give Iberian buyers broad coverage, backed by Thales's global SOC network.
Thales ownership brings scale and defence and critical-infrastructure reach. Standalone growth signals are limited, and staff figures (about 400) have been flat since 2022.
A conventional SOC/MDR and consulting provider with a standard delivery model.
The Trusted Introducer and FIRST CERT memberships (since 2011) are independent, but no public analyst placements or independent outcome data were found.
NIS2, Spain's ENS requirements and Thales's defence and critical-infrastructure clients keep Iberian managed SOC and OT security in steady demand.
Why CISOs Should Care
A good fit for Spanish and Portuguese organisations, especially in critical infrastructure and OT, that want a local SOC and CERT backed by a major European defence group.
What Makes It Different
It has a 25-year Iberian track record with Spain's first private SOC and a long-accredited CERT, plus OT expertise and Thales group backing.
The Matrix Verdict
57/100 — INCREMENTAL INNOVATOR
Score 34/60 (57/100): Incremental Innovator. It is a solid, established regional MSSP whose value comes from local presence and Thales backing, not a new approach.
Editorial Note: Claims vs. Verified Findings
'First private SOC in Spain' and the service breadth are company claims. The Thales acquisition, about 400 staff at closing, and Trusted Introducer and FIRST CERT accreditation are independently verifiable.
Sources
Alternatives to S21sec
Orange Cyberdefense
Orange Group's cybersecurity services arm, offering managed detection and response, threat intelligence, CERT and consulting across Europe and…
ReliaQuest
ReliaQuest operates GreyMatter, a security operations platform that unifies detection, investigation, and response across a customer's existing security…
RADICL
A Boulder, Colorado-based cybersecurity-as-a-service provider built specifically for small and mid-sized Defense Industrial Base contractors, combining managed detection…
CPX
Abu Dhabi cybersecurity company, a G42 company, offering managed detection and response, SOC operations, consulting and in-house security…
Arctic Wolf
Managed detection and response provider delivering a 24/7 human 'Concierge Security Team' as a de facto outsourced SOC…
Blackpoint Cyber
Managed detection and response (MDR) platform built by former NSA operatives, delivered exclusively through managed service providers and…