Service
From the call to recovery, one team.
Call, containment, forensics and recovery in a pre-agreed order. A retainer contract guarantees the response time.
- Retainer
- 24/7
- Playbook
- Tabletop
Why it matters
The problem
An incident arrives unexpectedly, but the response to it must not. Under a retainer the team studies your infrastructure in advance; communication channels and responsible people are agreed.
Our answer
When the call comes, work starts from the first minute: assessment, containment, forensics, recovery, and a conclusion on what to change after the incident.
What is included
06 modulesIncident response 24/7
- Retainer
- 24/7
- Playbook
- Tabletop
- 01
Retainer contract
Response time, communication channels, legal boundaries and responsible people are set in advance.
- 02
24/7 call
Phone and Telegram, around the clock. No queue.
- 03
Playbooks
Response scenarios for typical incidents: ransomware, account compromise, data leak.
- 04
Tabletop exercises
A desk exercise with your team: who does what, which decision is made when.
- 05
Forensics
Entry point, timeline, affected data, fit to serve as evidence.
- 06
Recovery
Return to a clean state and a plan against re-entry.
How it goes
04 steps
- 01
Preparation
The infrastructure is studied; playbooks and the communication procedure are agreed.
- 02
Call and assessment
Scope, affected systems, whether the attack is ongoing.
- 03
Containment and forensics
The spread is stopped, evidence preserved, the cause established.
- 04
Recovery and conclusions
Systems are restored; a post-incident report is delivered.
What you get
- 01
Guaranteed response
Work starts within the time fixed in the contract.
- 02
Forensics report
Timeline, entry point, scope of affected data.
- 03
Post-incident plan
Gaps to close and prevention measures.
Questions
All servicesWhat does a retainer give?
A guaranteed response time and a team that already knows your infrastructure. Preparation work continues even without calls.
Can I call without a retainer?
Yes, subject to capacity and queue. The response time is not guaranteed.
What should we not do during an incident?
Do not switch the server off in a hurry, do not destroy evidence, do not negotiate with the attacker yourself. Contact us first.
Do you help with regulator notification?
Yes, we advise on notification deadlines and content.
Let’s start
Start with a free external check
Give us your domain and we return a first report on your external attack surface and leaked accounts. Nothing is installed, nothing is blocked; the scope is agreed based on the result.
- Subdomains, open ports and expired certificates
- Corporate accounts found in breaches
- The three most important issues and where to start