Do you have an incident in progress? Email [email protected] and mark it as urgent to ask about our availability.
While you reach us
- Disconnect the affected computers from the network, without turning them off.
- Do not delete files, emails or logs.
- If you think your email is compromised, do not write to us from it: use the form on this page.
For companies facing an attack in progress or a recent one
Incident response and digital forensics
We help you contain the attack and understand how it got in and what it affected. We also help you gather the evidence you will be asked for.
Is the incident already over? Free 30-minute consultation to review what is still open. Containment and digital forensics are quoted separately.
Pralogy, a cybersecurity firm headquartered in Miami, with an office in Bogotá, Colombia, responds to company incidents: ransomware, compromised email, fraud, unauthorized cloud access and compromised websites. Our engineering team handles your request. We guide containment with your IT team, investigate with chain of custody and deliver a forensic report that sets out the timeline and separates facts from hypotheses.
Is this happening to you?
“Our files have been encrypted and there is a ransom note.”
“A company email account is sending messages no one wrote.”
“A supplier tells us they received a fake invoice in our name.”
“Our website shows strange content or redirects to pages that are not ours.”
“We see unusual sign-ins to our cloud accounts and do not know when they started.”
Is it happening now? Email [email protected] and mark it as urgent to ask about our availability. Is it already over? Request a free 30-minute consultation to talk about what happened and what is still open.
How we handle an incident
We tell you what to do first
What to isolate, what not to delete and which passwords to change.
Guided containment
With your IT team or your IT provider.
Forensic investigation with chain of custody
We look for how the attacker got in, what was affected and whether data was taken.
Report with the timeline
The facts, kept separate from the hypotheses. It gives you technical support for any reports you have to file.
Safe recovery and a controls plan
To reduce the risk of it happening again, with emergency training for your staff if needed.
Documented case
A real incident
How a compromised corporate email account was handled
Organization with sensitive data
< 1 hour
All of the client's staff received the alert.
Same day
Containment, with no disruption to operations reported by the client.
2 days
Preliminary forensic report.
Afterward
Support with reporting obligations and emergency training for the staff.
Insurance claim
The client's insurer accepted the forensic report.
These times are from this case, not a response-time commitment.
How to engage us for an incident
If you are not a client yet, email [email protected] or use the form to ask about our availability. Then we agree on the scope: incident response is quoted based on that scope.
- We sign a nondisclosure agreement (NDA) before we start.
- For managed security program clients, the contract includes a response within 8 business hours at most and 24/7 forensic response.
Do you have to report the incident?
We provide the technical support and the forensic report. Your attorney handles the legal side.
| If… | What the law may require |
|---|---|
| The incident affects personal data (of clients, employees or suppliers) | Data protection laws may require you to report it to a regulator within a set deadline. |
A summary for information only; it is not legal advice.
What you receive
Forensic report with the timeline
How the attacker got in, what was affected and whether data was taken, as far as the evidence allows.
The facts, kept separate from the hypotheses
We state clearly what was demonstrated, what was not and what could not be determined.
Evidence preserved with chain of custody
Technical support for reporting to a regulator
Your attorney handles the legal side.
The report for your insurer
We deliver it for your claim. We have experience delivering the forensic report that the client's insurer requires.
A controls plan to reduce the risk
Plus emergency training for your staff, if needed.
The same, on an ongoing basis
If something happens again, have it handled by someone who already knows your environment. With the managed security program, a team works on your security all year.
Frequently asked questions
What should I do in the first minutes of an attack?
Disconnect the affected computers from the network, without turning them off or deleting anything. If you think your email is compromised, do not write to us from it: use the form on this page. Otherwise, email [email protected] and mark it as urgent to ask about our availability.
Do I have to report the incident to a regulator?
If it affects personal data, data protection laws may require you to report it to a regulator within a set deadline. We provide the technical support and the forensic report; your attorney handles the legal side.
What is digital forensics?
It is the technical investigation of an incident: the evidence is preserved with chain of custody, and we reconstruct what happened, how the attacker got in and what was affected. What can be established depends on the available evidence.
What does the forensic report include?
The incident timeline, how the attacker got in, what was affected, whether data was taken and the facts kept separate from the hypotheses. If something could not be determined, the report says so.
Can you recover files encrypted by ransomware?
It depends on your backups and on the type of attack, so we do not promise it in advance. We tell you honestly what can be recovered.
Do you respond outside business hours?
For managed security program clients, the contract includes a response within 8 business hours at most and 24/7 forensic response. If you are not a client yet, email [email protected] and mark it as urgent to ask about our availability.
How much does incident response cost?
Incident response is quoted based on the scope of the incident. If you are in our managed security program, it is handled under your contract. If the incident is already over, the free 30-minute consultation helps you review what is still open.
Our IT team already fixed it. Why do we need you?
Do you know how the attacker got in and whether any data was taken? If not, the incident may still be open. We work alongside your IT team or your IT provider.
Will the incident be kept confidential?
We sign a nondisclosure agreement (NDA) before we start. We explain what you may have to report by law; the legal decision is yours and your attorney's.
How do we keep it from happening again?
You can reduce the risk with a controls plan and, if you want, with the managed security program: a team that already knows your environment works on your security all year.
Do you handle hacked websites, personal accounts or social media?
We handle company websites, including WordPress sites: cleanup is quoted per project, after the free 30-minute consultation. For personal accounts and social media, the fastest route is each platform's support team, since our service is for companies and organizations.
Is the incident already over?
Free 30-minute consultation: we talk about what happened and what is still open, and we suggest how to move forward.
Is it still in progress? Email [email protected] and mark it as urgent to ask about our availability.