During an attack we deploy 24/7, stop propagation, preserve evidence and run root-cause analysis and the recovery plan.
Retainer from 180,000 TRY; incident-based quote
In an incident, the first hours decide the outcome. Our emergency response team deploys remotely or on site, evicts the attacker, isolates affected systems and prioritises business continuity.
Response steps
- Detection and scoping: affected systems, accounts and data
- Stopping propagation and closing attacker access
- Memory and disk imaging, log collection; chain of custody suitable for court evidence
- Root-cause analysis and attack timeline
- Recovery, rebuild and hardening recommendations
Legal process
Where needed we coordinate KVKK Board notification, the insurer and legal counsel. With an Incident Response Retainer you get a yearly hour bank and a two-hour response commitment.
Scope of service
- 24/7 emergency hotline
- Court-grade forensic imaging
- Root-cause report
- Two-hour response with retainer
Incident Response & Digital Forensics — get a quote
Fill in the form and we will get back to you as soon as possible.
Frequently asked questions
What is a SOC service and how does it differ from building our own team?
True 24/7 monitoring needs a shift team of at least 8–10 people, a SIEM licence and detection engineering. A managed SOC provides this capacity on a shared basis; setup drops from months to weeks and cost is typically a third of an in-house team.
Will a penetration test affect our live systems?
Tests follow the rules of engagement approved in the scoping document. Destructive techniques (DoS, data deletion) are not used; risky actions are announced in advance and preferably performed in a maintenance window.
How long does a penetration test take?
A mid-sized web application takes 8–10 working days, a corporate internal network test 10–15. The report is delivered within five working days of test completion; retesting after fixes is included.
What should we do in a KVKK breach?
A data breach must be notified to the Personal Data Protection Board within 72 hours of becoming aware, and to affected individuals within a reasonable time. If you reach us through the incident form we manage forensics and the legal notification together.
Should we pay the ransom after a ransomware attack?
Payment guarantees nothing and encourages attackers. First isolate, verify backups and check for decryptors. The decision belongs to senior management after a legal and business-impact analysis; we provide technical and strategic advice.