Incident response
We contain the attack, find out what has happened and help you get your business running again.
- Line staffed 24 hours a day, 7 days a week
- First response in under 4 hours during business hours
- Up to 8 hours in the first intervention
- On site in the Comunidad de Madrid if needed
We provide incident response in Móstoles, across the Comunidad de Madrid and, remotely, anywhere in Spain.
It is for when something has already happened: ransomware, a stolen email account or CEO fraud.
We contain the attack, find out what has happened and help you get your business running again. We also support you with the mandatory notifications.
Read more Read less
Our incident line is staffed 24 hours a day, 7 days a week. During business hours, we give a first response in under 4 hours. You do not need to have any other service with us. We tell you what to do first and what to expect from each step, without drama and without promising what is not yet known.
Request a quote
To talk about incident response, call or write to us and we'll tell you the next steps.
How we help you
- Encrypted files and a ransom note
- A mailbox sending messages in your name
- An urgent payment order that seemed to come from management
- A computer or server behaving strangely
- Notifications to the Spanish Data Protection Agency (AEPD) if personal data is affected
- Final report for management, for your insurer and, if needed, for a police report
What incident response is
A security incident is an event that puts a company's data, accounts or systems at risk.
It may be an attack that has already done damage, or something odd that nobody can yet explain. Incident response is the orderly work carried out from that moment on.
We act on ransomware, stolen email accounts and CEO fraud. Ransomware encrypts files and demands a ransom. A stolen account gives someone else access to a company mailbox.
In CEO fraud, someone poses as management to obtain a payment.
Read more Read less
Our work has three parts: containing the attack, finding out what has happened and helping you get your business running again. We also support you with the mandatory notifications. Nobody can know how an incident will end before investigating it. What depends on us is following a procedure and telling you clearly what we are finding.
Which companies it is for
It is for any company that is suffering, or has just suffered, an attack, whether or not it has another service with us.
It can be engaged on the spot. You do not need to have worked with us before. Just call and tell us what is happening.
Read more Read less
You do not need an IT department either. If you have one, or if you work with an external provider, keep their details to hand, because they know the company's systems and are usually helpful during the intervention.
When it makes sense to call
These are common situations. You do not need to be sure it is an attack before calling: sometimes all you can see is something that does not add up.
- The company's files appear encrypted and there is a ransom note.
- Someone has got into a mailbox and is sending messages in your name.
- Accounts has received an urgent payment order that seemed to come from management.
- A computer or server is behaving strangely and you do not know why.
Read more Read less
Each situation calls for different things. If files are encrypted, the first priority is to stop the problem spreading. If someone is using a company mailbox, their messages may look legitimate to the people who receive them. If a doubtful payment order has arrived, it is wise to confirm it with the person who supposedly sent it, through a channel other than the email itself.
How we work during an incident
We always follow the same order. First we stop the situation getting worse, and then we look for the cause. Investigating before the attack is contained leaves the door open.
And recovering without knowing what has happened can bring the problem back into the systems.
Read more Read less
At the end, you receive a final report and a set of measures. Their aim is to reduce the risk of it happening again, because no provider can guarantee that a company will never suffer another incident.
How we get started
- You call the incident line and we give you the first instructions so the situation does not get worse.
- We contain the attack so that it does not spread.
- We investigate what has happened and which data has been affected.
- We get your business running again together with your team or your IT provider.
- We deliver the final report and the measures to reduce the risk of it happening again.
- A call to the incident line and first instructions so the situation does not get worse.
- Containment of the attack so that it does not spread.
- Investigation of what has happened and which data has been affected.
- Getting your business running again together with your team or your provider.
- Final report and measures to reduce the risk of it happening again.
What the service includes
The incident line is staffed 24 hours a day, 7 days a week. The first response in under 4 hours is a separate commitment and applies during business hours.
Containment is adapted to what is happening: it may mean isolating computers, cutting off access or changing credentials.
Evidence is preserved from the start in case a police report is needed.
- Incident line staffed 24 hours a day, 7 days a week.
- First response in under 4 hours during business hours.
- Containment: isolating computers, cutting off access and changing credentials.
- Investigation of the origin and scope of the incident.
- Preservation of evidence in case a police report is needed.
- Support with notifying the Spanish Data Protection Agency (AEPD) if personal data is affected.
- Final report for management, for your insurer and, if needed, for a police report.
- Up to 8 hours of work in the first intervention.
Price and first response time
The first intervention has a fixed price and includes up to 8 hours of work. Call us and we will tell you the amount.
If more time is needed, we give you a written quote before going further. Our prices exclude VAT (21%).
During business hours, we give a first response in under 4 hours.
The total duration of an incident cannot be set in advance, because it depends on its scope, the systems affected and the state of the backups.
Line staffed 24 hours a day, 7 days a week
What it does not include
- Hours beyond the 8 of the first intervention, which are quoted in writing before going further.
- Full reinstallation of computers and applications, which is quoted case by case.
- Legal representation before the authorities or the courts.
Read more Read less
We prefer to make this clear from the start, so you know what the first intervention covers and what is decided later.
If the incident ends up in legal proceedings, you will need a lawyer for that part. Our final report can support a police report, but we do not represent the company before the authorities or the courts.
Who leads the service
Aitor is responsible for management and client relations.
If you have a question about the service or a quote, you can ask for him.
Where we work
We work remotely anywhere in Spain and on site in the Comunidad de Madrid.
In the Comunidad de Madrid we can come to your premises in person if needed. In the rest of Spain, the intervention is carried out remotely.
When you call, we work out which way of working suits what is happening.
What to know before you call
If you think you are under attack, do not erase anything or reinstall any computers. Disconnect them from the network and wait for instructions.
The evidence helps establish what has happened.
Recovering the files depends on your backups. If the attacker has not reached them, we recover from them. If there are no backups, recovery is not always possible.
Read more Read less
On notifications, we give general information and help you prepare them. What each company is obliged to do depends on its case and on the data affected. Below you will find the most frequently asked questions, including the cost of the first intervention.
Questions about incident response
What do I do if I have already been attacked?
Call the incident line as soon as possible. Do not erase anything or reinstall any computers. Disconnect them from the network and wait for instructions, because the evidence helps establish what has happened.
Can I call if I am not a client?
Yes. Incident response can be engaged on the spot, without having any other service with us.
How much does it cost?
The first intervention has a fixed price and includes up to 8 hours of work. Call us and we will tell you the amount. If more time is needed, we give you a written quote before going further. Our prices exclude VAT (21%).
Can encrypted files be recovered?
It depends on your backups. If there are backups the attacker has not reached, we recover from them. Without backups, recovery is not always possible, and we will tell you so plainly from the start.
Can someone come to our premises?
In the Comunidad de Madrid we can come in person if needed. In the rest of Spain we work remotely.
What if it happens outside business hours?
The incident line is staffed 24 hours a day, 7 days a week, so you can call at any time. The first response time of under 4 hours applies during business hours.
What do I receive when the intervention ends?
A final report for management, which also serves for your insurer and, if needed, for a police report. It includes measures to reduce the risk of it happening again.
24/7 monitoring and response
Managed SOC for SMEs: we monitor computers and servers around the clock, analyse the alerts and, if an attack is real, we contain it and let you know.
Backup and continuity
Immutable backups stored off your premises and recovery tests with the time measured.
Exposure assessment
We review from the outside what an attacker can see of your company and give you a report for management and a prioritised plan.
Microsoft 365 and Google Workspace security
We review and strengthen the configuration of your Microsoft 365 or Google Workspace: access, email and devices.
Security awareness and phishing simulation
Practical training for your staff and simulated phishing emails, with aggregated results for management.
If something has happened, call us
Call us on +34699240879 and tell us what you are seeing, in your own words. You do not need to have it all clear.
Our incident line is staffed 24 hours a day, 7 days a week.
If it is not an ongoing incident and you would like to ask us about the service, you can also write to [email protected].