Productincident.uz
The first hour is the most expensive hour.
24/7 incident response: a pre-agreed procedure from the call to containment, forensics with evidence preserved, and a return to a clean state.
- 24/7
- Containment
- Forensics
- Recovery
Why it matters
The problem
During an incident decisions are made in a hurry, and those decisions set the size of the damage. A server switched off in panic destroys evidence; a system left untouched gives the attacker time. Without a procedure agreed in advance, the first hour goes to chaos.
Our answer
Incident Response is that procedure. A retainer contract guarantees the response time, the team already knows your infrastructure and starts working from the first minute after the call.
What is included
06 modulesIncident Response
- 24/7
- Containment
- Forensics
- Recovery
- 01
24/7 call line
Phone and Telegram, around the clock in any time zone. Whoever takes the call starts working immediately; there is no queue.
- 02
Containment
Infected hosts are isolated, compromised accounts blocked, entry points closed, with evidence preserved.
- 03
Forensics
How they got in, when it started and what was touched. The timeline and evidence go into the report.
- 04
Recovery
Systems are returned to a clean state, the entry path is closed, measures against a repeat are agreed.
- 05
Retainer
A contract signed in advance: response time, communication channels, responsible people and legal boundaries.
- 06
Preparation
Tabletop exercises and response playbooks: your team knows in advance who does what when an incident hits.
How it goes
04 steps
- 01
Call and assessment
We quickly establish what happened: scope, affected systems, whether the attack is ongoing. First recommendations are given at this stage.
- 02
Containment
The spread is stopped. Every step is taken with evidence preservation in mind.
- 03
Forensics
Entry point, timeline and the scope of affected data are established.
- 04
Recovery and conclusions
Systems are restored; a post-incident report and a prevention plan are delivered.
What you get
- 01
Fast containment
A step-by-step record of what was stopped and what was done.
- 02
Forensics report
Attack timeline, entry point and cause, scope of affected data, fit to serve as evidence.
- 03
Recovery and prevention plan
The procedure for returning to a clean state and the list of gaps to close.
Questions
All productsCan I call without a retainer?
Yes. A retainer guarantees the response time and lets the team study your infrastructure in advance; without one, a call is taken subject to capacity and queue.
How fast is the first response?
The time is fixed in the contract and depends on scope. We do not print a general number here because it differs by service level.
Should I switch the server off?
Usually not. Switching off in a hurry destroys evidence. Contact us first: disconnecting from the network and powering off are different things.
Do you help with regulator notification?
Yes. The report is written with regulator requirements in mind; we advise on notification deadlines and content.
Let’s start
Start with a free external check
Give us your domain and we return a first report on your external attack surface and leaked accounts. Nothing is installed, nothing is blocked; the scope is agreed based on the result.
- Subdomains, open ports and expired certificates
- Corporate accounts found in breaches
- The three most important issues and where to start