Vorpcel / Services / Defense and response
When something has gone wrong, we help you stop it from spreading, find out how it started and what was reached, remove the attacker and get back to normal operation with the evidence preserved.
At a glance
During an incident, two mistakes are common: acting too late, and acting too fast. Turning machines off or reinstalling them before the evidence is collected can hide how the attacker got in, and leave the same door open.
Our first job is to give you a clear picture and a plan: what to contain now, what to preserve, who needs to be told and when. Then we do the work with your team, step by step, and keep a written record of every decision.
Files renamed or encrypted, or a ransom note on a server or shared folder.
Access to email, cloud or administrator accounts from places or at times that make no sense.
New accounts, changed permissions, new programs or scheduled tasks that nobody on the team created.
A customer, a partner, a bank or the authorities report something linked to your company.
Company or customer data offered or published somewhere it should not be.
A security tool raised something serious and the team is not sure what it means.
These phases follow the incident handling guidance published by NIST. In practice they overlap: containment starts while the investigation is still running.
We confirm what is happening, isolate affected machines and accounts, and stop the spread without destroying evidence.
We collect logs, disk and memory evidence and rebuild the timeline: how the attacker got in, what they did and what they reached.
We remove persistence, reset exposed credentials and guide the return of systems to service, watching for the attacker coming back.
We deliver the final report and a meeting to agree on the changes that prevent the same incident from happening again.
Containment, scope of encryption and data theft, safe recovery from backups and support for the decisions that follow.
Compromised email, cloud or administrator accounts: what was accessed, what was changed and how to lock it down.
What data left, from where and to whom, with the facts you need for notifications under LGPD and other laws.
Defaced sites, injected scripts that steal card data, web shells and abused APIs.
Leaked keys, unexpected resources, exposed storage and changes made by an unknown identity.
An alert you cannot explain. We tell you whether it is an incident, and if it is not, why.
The best time to agree on how an incident will be handled is before it happens. A retainer gives you a contract, contacts and a plan already in place.
Hours agreed in advance, a response time in the contract and no negotiation during the crisis. Unused hours can go to readiness work.
Who decides, who is called, how to reach them when email is down and what to tell customers, written for your company.
A realistic scenario played with your technical team and leadership, to find the gaps in the plan while nothing is at stake.
Sign-ins, program executions and changes on the affected machines and servers.
Copies taken before machines are cleaned, so evidence of what ran is not lost.
Audit trails of cloud accounts and mailboxes, where many incidents start.
Firewall, proxy and DNS records that show where data went and what connected to what.
What your team saw and did, and when, written down while it is fresh.
A record of who collected each piece of evidence, when and how it was kept.
You can call us in the middle of an incident, or agree on everything before one happens.
| Option | Best for | What it includes |
|---|---|---|
| Emergency response | An incident that is happening now | Triage, containment, investigation, recovery support and the final report |
| Incident response retainer | Being ready before anything happens | Hours agreed in advance, a response time in the contract, a response plan and a yearly tabletop exercise |
Do not turn off or reinstall the affected machines yet. Disconnect them from the network if the attack is spreading, write down what you have seen and when, and contact us through the form with the word incident in the message.
No. We respond on the systems and tools you have. If you use the Vorpcel agent, isolation and evidence collection are faster because they can be done from the console.
Yes. We keep a chain of custody for the evidence and write the report so it can be shared with insurers, lawyers and the authorities when that is needed.
No. We give you the technical facts that support the decision, such as what data was taken and whether backups are usable. The decision stays with you and your advisors.
Most of the work can be done remotely, with access you grant to the affected systems and logs. When someone needs to be on site, we agree on it with you.
We give you the technical facts the notification needs: what happened, which data was involved and when. The legal assessment and the notification itself stay with you and your lawyers.
We reply with a few questions about scope, then send a proposal with dates and price.