When an incident is under way, containment comes first: we stop the spread, preserve the evidence, work out what happened and restore operations in a defined order.
We isolate what is affected and cut the attacker's access without destroying evidence.
We reconstruct what happened, how they got in, what they touched and which data may have been exposed.
We close the way in, clean up and bring services back in the order your business needs.
We document the incident and leave a plan so it does not happen again through the same route.
Walk through an illustrative incident, from an email to the data, and see at each moment what can be contained, what evidence exists and what the team does.
Slide or use the arrow keys. Times are hours and minutes since the initial access.
00:00 since the initial access
What can be stopped
No intrusion is confirmed yet. Isolating the message and the devices that opened it prevents the next step.
What evidence exists
The original email with its headers, the mail server logs and the list of who received it.
What the team does
Triage: confirm what happened, preserve evidence from the first moment and tell whoever decides.
00:27 since the initial access
What can be stopped
The account can be blocked, active sessions closed and credentials reset before they are used on other systems.
What evidence exists
The account's sign-in logs, where the accesses came from and the activity in the mailbox.
What the team does
Contain the affected account and analyze logs and accounts to learn whether the credential was used, and from where.
01:40 since the initial access
What can be stopped
Isolate the devices involved and cut the attacker's access to accounts with more permissions.
What evidence exists
Changes to accounts and permissions, and the logs of the devices and servers the attacker moved through.
What the team does
Isolate without destroying evidence, reconstruct the route taken and begin removing the attacker's access.
03:15 since the initial access
What can be stopped
Close the exit routes and protect the data not yet reached.
What evidence exists
File access and transfer logs, which show which data may have been compromised.
What the team does
Brief leadership with technical clarity, eradicate the access, restore services and prepare the post-incident report.
We group experiences without identifying clients or publishing sensitive data. Results correspond to the documented scope of each engagement.
Identities withheld
Disconnect the affected machines from the network, keep everything you see (ransom notes, emails, logs) and contact us before shutting down, wiping or reinstalling. Those actions can destroy useful evidence.
It is a business and legal decision that we do not make for you. We give you the technical facts to decide: what was encrypted, whether usable backups exist and what the risk of data exposure is.
It depends on the case: on the variant, on the available backups and on what can be restored. We assess it from the first analysis and tell you what is possible. Cyber Recovery is a service of its own.
Technical investigation with traceability and evidence for incidents and internal cases.
Secure restoration of information, systems and backups after loss, damage or encryption, focused on business continuity.
Controlled tests to validate real gaps and define effective remediation.
Tell us what is happening and how to reach you. A SoluProTec specialist reviews your notice and contacts you through the channel you provide.
