How we work
Four stages, from the first call to a closed gap.
You always know which stage we are in and what comes next.
Contain
What we do
We help you isolate affected systems, secure untouched backups and accounts, and capture volatile evidence before it disappears.
You get
An incident that has stopped growing, with evidence intact.
Investigate
What we do
We analyse logs, systems and the malware itself to identify the entry point, the scope of damage and the exact ransomware strain.
You get
A defined scope and an attack timeline.
Recover
What we do
Where a decryption path exists we take it. Where it doesn’t, our own tools reconstruct files and databases, verified at every step.
You get
Verified data, handed back in a usable form.
Harden
What we do
We fix the weakness that was exploited, tighten access, and set up backups that attackers cannot reach or delete.
You get
The final report and an environment that is harder to hit.