SERVICE
Incident response · DFIR
Containment in hours, evidence with chain of custody and regulatory support, from the first call to lessons learned. With a retainer, the team already knows your environment and the 3 a.m. call doesn't start from zero.
The methodology, step by step
Preparation
Retainer with a pre-scoped profile: contacts, topology and access agreed before the crisis.
Activation < 4 h
The team engages remotely within hours, it already knows your environment; the 3 a.m. call doesn't start from zero.
Triage & containment
✦ AI AGENTAI agents reconstruct the attack timeline at machine scale; the analyst decides containment.
Forensics with custody
Evidence preserved and documented with chain of custody for legal and regulatory use.
Eradication & recovery
Cause and persistence removed; back to operation with verification.
Regulatory report
✦ AI AGENTAI drafts the report and the notification (Law 172-13, 72 h); the DFIR lead signs it.
Pick the tier that answers your question
The price is fixed in writing after a 30-minute scoping and does not change during the contract.
Ad-hoc emergency
DFIR retainer
CROC + retainer
Thirty minutes and we tell you frankly what you need.
Sometimes the answer is "you don't need us yet." We prefer that to selling you something you won't use.