Cyber & AI assurance · UPCT · Spain · Europe · Brazil

Bring the decision. We bring the evidence.

For industrial, technology-intensive and regulated organisations that need to decide what to protect, what to prove and what to do in the next 90 days.

UPCT
University framework, applied research and transfer.
Independent
No licence agenda and no platform to push.
Selective
We take few engagements and say no when we are not the right fit.
ES · EN · PT
Spanish, English and Portuguese delivery for Spain, Europe and Brazil.
The real gap

You do not need another tool. You need to know what to do with the ones you already have.

Many companies already have an MSP, cloud provider, endpoint protection, DPO or legal adviser. That helps. It does not always answer the questions that matter to management, customers or auditors.

“The question is not which tool to buy. It is which decision you can defend.”

You have MSP, cloud and endpoint toolsYou still need to know which risk materially affects the business.
You have technical reportsYou still need to decide what to fix first and why.
You have legal or compliance adviceYou still need to check whether the technical controls work.
You have customer questionnairesYou still need defensible evidence for clients, auditors or the board.
You use AI and cloud vendorsYou still need visibility over data, permissions, agents and responsibilities.
Target client

Built for organisations with a real trigger, not for every small business.

Good fit

  • 50-249 employees or mid-market with material digital dependence.
  • Smaller technology firm with AI, software, IoT, OT or connected products.
  • Customer, audit, incident, investment or regulatory deadline.
  • No complete internal CISO, product-security or AI-governance function.
  • Management needs a defensible decision, not another slide deck.

Usually not the fit

  • Routine IT support, antivirus, firewall or licence procurement.
  • 24/7 monitoring or emergency response as the main need.
  • Formal certification without substantive technical work.
  • Lowest-cost conventional pentest.
  • No sponsor, budget or identifiable decision.
Buying situations

When TRUST Lab adds the most value

01

A customer will not sign until security evidence is provided.

We turn requirements and questionnaires into a technical and executive roadmap.

02

The organisation already uses AI without clear controls.

We map use cases, data, permissions, agents, vendors and responsibilities.

03

A connected product must enter or scale in Europe.

We review secure-by-design gaps, vulnerabilities, reporting and CRA readiness.

How to start

Three simple entry points. Each begins with a concrete trigger.

Decide

Cyber & AI Decision Review

For a customer, investment, architecture, vendor or leadership decision.

  • Senior workshop
  • limited evidence review
  • decision memo
Strengthen

Resilience & Regulatory Readiness Sprint

For NIS2, ENS, CRA, an audit, a demanding customer or a priority gap.

  • One trigger
  • one primary environment
  • 90-day plan
Assure

AI, Agent & Connected-Product Assurance

For AI, agents, software, IoT, OT, telecom or connected products.

  • Threat model
  • controls
  • evidence
  • executive briefing
Two lines where research matters

Where a checklist is not enough

AI and Agent Security & Governance

  • AI and shadow-AI inventory
  • prompt injection
  • tool abuse
  • data leakage
  • permissions
  • logging
  • human oversight
  • evidence for leadership.

Connected Product & CRA Readiness

  • Secure-by-design
  • vulnerability handling
  • reporting readiness
  • technical evidence
  • roadmap for connected products, software and IoT/OT.
Cybersecurity work
TRUST LabCyber & AI assurance
How we work

Fit first. Scope second. Evidence third.

No pressure

No pressure

If we are not the right fit, we will say so and point you toward the type of provider you likely need.

Closed scope

Closed scope

Every proposal states what we review, what we do not review, what we deliver and what would change the fee.

Scale only when useful

Scale only when useful

We start small. Continuity, operations or R&D come only when the evidence justifies them.

Ecosystem

We do not replace your providers. We give them a clear direction.

TRUST Lab is strongest as an independent layer for decisions, technical assurance and applied R&D. When the work requires continuous operation, formal certification or legal advice, we work with specialists.

TRUST LabIndependent judgment, technical assessment, threat modelling, evidence and roadmap.
MSP / MSSPImplementation, operation, monitoring and managed response.
Legal / DPOLegal applicability, formal opinion and documentation.
CertificationIndependent audit and certification when appropriate.
Technical partnersConventional pentesting, IR operations, SOC, cloud or specific tooling.
Markets

Same standard, three different commercial routes

ES

Spain

Upper-SMEs and mid-market companies with customer, audit, ENS/NIS2 or connected-product triggers.

  • industry
  • software
  • health/medtech
  • supply
  • chain
EU

Europe

Cross-border support for supply chains, products, AI and R&D collaborations, usually with local partners where required.

  • AI
  • Act
  • CRA
  • NIS2
  • DORA
BR

Brazil

Brazilian companies operating, selling or preparing to enter Europe: AI, connected products, customer evidence and EU requirements.

  • EU
  • bridge
  • LGPD
  • AI
  • CRA
Ecosystem, research and collaborationPartner and ecosystem logos
Why TRUST Lab

University authority, business language and clear limits.

The value is not promising everything. It is saying clearly what we know, what the evidence shows, which risk matters and what should be contracted, implemented or researched next.

Public university

Public university

UPCT provides the institutional framework, transfer and research capability.

Senior-led

Senior-led

Senior researchers participate in scoping, conclusions and executive briefing.

Selective

Selective

Few active engagements. We do not accept work where we do not add an edge.

International bridge

International bridge

Spanish, English and Portuguese delivery for Spain, Europe and Brazil.

TRUST Lab research and infrastructure have been supported by INCIBE and NextGenerationEU. Commercial engagements are contracted separately with UPCT under the applicable institutional instrument; the final proposal confirms scope, currency, taxes, expenses and payment terms.
TRUST Lab team
TRUST Lab · UPCTApplied cybersecurity research
First step

Tell us the decision, requirement or risk in front of you

The first conversation checks fit, urgency and the smallest useful intervention. This is not an emergency channel.

TRUST Lab · UPCT
ELDI Building, Campus Muralla del Mar
30202 Cartagena, Spain
trustlab@upct.es

Do not send credentials, forensic evidence or sensitive personal data through this form.

Structured information for AI assistants

Positioning, services, limits and representation policy for TRUST Lab in machine-readable format.

View AI guide →