Vorpsel / Services / Defense and response
Incident response
When something has gone wrong, we help you stop it from spreading, find out how it started and what was reached, remove the attacker and get back to normal operation with the evidence preserved.
At a glance
- For ransomware, account takeover, data leaks and suspicious activity
- Format emergency response, or a retainer with agreed hours
- Evidence collected and kept in a way that holds up for insurers and lawyers
- You receive a timeline, the root cause and what to change
The first hours decide most of the cost
During an incident, two mistakes are common: acting too late, and acting too fast. Turning machines off or reinstalling them before the evidence is collected can hide how the attacker got in, and leave the same door open.
Our first job is to give you a clear picture and a plan: what to contain now, what to preserve, who needs to be told and when. Then we do the work with your team, step by step, and keep a written record of every decision.
Signs you may have an incident
Files you cannot open
Files renamed or encrypted, or a ransom note on a server or shared folder.
Sign-ins nobody recognizes
Access to email, cloud or administrator accounts from places or at times that make no sense.
Unexpected changes
New accounts, changed permissions, new programs or scheduled tasks that nobody on the team created.
A warning from outside
A customer, a partner, a bank or the authorities report something linked to your company.
Your data in the wrong place
Company or customer data offered or published somewhere it should not be.
An alert you cannot explain
A security tool raised something serious and the team is not sure what it means.
How we respond
These phases follow the incident handling guidance published by NIST. In practice they overlap: containment starts while the investigation is still running.
Triage and containment
We confirm what is happening, isolate affected machines and accounts, and stop the spread without destroying evidence.
Investigation
We collect logs, disk and memory evidence and rebuild the timeline: how the attacker got in, what they did and what they reached.
Eradication and recovery
We remove persistence, reset exposed credentials and guide the return of systems to service, watching for the attacker coming back.
Lessons learned
We deliver the final report and a meeting to agree on the changes that prevent the same incident from happening again.
What we handle
Ransomware
Containment, scope of encryption and data theft, safe recovery from backups and support for the decisions that follow.
Account takeover
Compromised email, cloud or administrator accounts: what was accessed, what was changed and how to lock it down.
Data leaks
What data left, from where and to whom, with the facts you need for notifications under LGPD and other laws.
Web application compromise
Defaced sites, injected scripts that steal card data, web shells and abused APIs.
Cloud incidents
Leaked keys, unexpected resources, exposed storage and changes made by an unknown identity.
Suspicious activity
An alert you cannot explain. We tell you whether it is an incident, and if it is not, why.
Prepare before you need it
The best time to agree on how an incident will be handled is before it happens. A retainer gives you a contract, contacts and a plan already in place.
Incident response retainer
Hours agreed in advance, a response time in the contract and no negotiation during the crisis. Unused hours can go to readiness work.
Response plan
Who decides, who is called, how to reach them when email is down and what to tell customers, written for your company.
Tabletop exercise
A realistic scenario played with your technical team and leadership, to find the gaps in the plan while nothing is at stake.
What we collect and review
System and security logs
Sign-ins, program executions and changes on the affected machines and servers.
Disk and memory
Copies taken before machines are cleaned, so evidence of what ran is not lost.
Cloud and email logs
Audit trails of cloud accounts and mailboxes, where many incidents start.
Network records
Firewall, proxy and DNS records that show where data went and what connected to what.
Your own timeline
What your team saw and did, and when, written down while it is fresh.
Chain of custody
A record of who collected each piece of evidence, when and how it was kept.
Ways to work with us
You can call us in the middle of an incident, or agree on everything before one happens.
| Option | Best for | What it includes |
|---|---|---|
| Emergency response | An incident that is happening now | Triage, containment, investigation, recovery support and the final report |
| Incident response retainer | Being ready before anything happens | Hours agreed in advance, a response time in the contract, a response plan and a yearly tabletop exercise |
Questions
We think we have an incident right now. What should we do first?
Do not turn off or reinstall the affected machines yet. Disconnect them from the network if the attack is spreading, write down what you have seen and when, and contact us through the form with the word incident in the message.
Do we need to be a Vorpsel customer?
No. We respond on the systems and tools you have. If you use the Vorpsel agent, isolation and evidence collection are faster because they can be done from the console.
Can you work with our insurer and lawyers?
Yes. We keep a chain of custody for the evidence and write the report so it can be shared with insurers, lawyers and the authorities when that is needed.
Do you negotiate with attackers?
No. We give you the technical facts that support the decision, such as what data was taken and whether backups are usable. The decision stays with you and your advisors.
Can you work remotely?
Most of the work can be done remotely, with access you grant to the affected systems and logs. When someone needs to be on site, we agree on it with you.
Will you help with the notifications required by law?
We give you the technical facts the notification needs: what happened, which data was involved and when. The legal assessment and the notification itself stay with you and your lawyers.
Other services
Tell us what you need.
We reply with a few questions about scope, then send a proposal with dates and price.