Rapid response to cyberattacks. Carried out by our CSIRT team.

Both. IT service providers can market it as an additional attractive business module, while small and medium-sized enterprises receive rapid assistance in an emergency.

Expanded service offerings that include cyber emergency support without having to set up your own emergency response team.

In the event of an incident, a well-coordinated team is immediately available to handle the situation and rapidly restore normal operations.

Immediately. The agreed-upon response time applies to your company right from day 1.

No. CSIRT Gold and Platinum also protect companies that do not operate their own SOC – our DFIR experts handle the guaranteed response.

Emergency response calls are billed at €2,900 per 8 hours for incident response and forensics, and €2,300 per 8 hours for prevention and consulting – for all CSIRT plans. Days of use in the AI and Forensics Lab are billed at €400.

Yes. You can adjust your CSIRT plan at any time – with no minimum term or retainer fees.

Yes. AI incident response is an integral part of modern CSIRT work – from prompt injection to data leaks via copilots to unintended actions by AI agents.

There is no minimum purchase requirement and no mandatory turnover. You can terminate the contract at any time. We do not require a retainer quota.

CSIRT stands for Cyber Security Incident Response Team. It refers to the crisis management team that intervenes in the event of security incidents and coordinates the technical and organizational response.

Both essentially mean the same thing: a specialized team that responds to cyber incidents, limits damage, secures evidence and oversees recovery.

An SOC detects and reports incidents, while a CSIRT responds to them. The SOC is the control center, and the CSIRT is the fire department.

The team assesses the situation, contains the spread, preserves evidence, assists with recovery, and works with IT and management to guide the next steps.

Incident response involves detecting, assessing, containing and documenting an incident, and then restoring operations in an orderly manner.

Forensics refers to the technical investigation of an incident. The goal of forensics is to understand what happened, how the attack unfolded and which systems were affected.

Containment means limiting the damage. This includes measures that stop the attacker and prevent further spread.

Recovery refers to the process of restoring systems, data and processes to their normal state following an incident.

When people are affected by an IT security incident, communication must be especially clear, calm and considerate. The Crisis Communication add-on supports government agencies, customers, partners, the media and internal stakeholders.

Yes. The structured workflow helps with documentation, escalation and the preparation of reports, for example in the context of NIS 2 or DORA.

CSIRT Gold and Platinum offer a 24/7 hotline to take your calls. In addition to the hotline, our CSIRT team is available 24/7 under CSIRT Platinum plans, and between 6 a.m. and 10 p.m.

The response time for phone calls is 30 minutes. The response time begins as soon as a DFIR expert starts working on the call or returns the call.

If you have subscribed to a CSIRT Gold or CSIRT Platinum plan, a team member will be on their way to you within 60 minutes, if necessary. Under the CSIRT Platinum plan, a second team member will provide remote support until we arrive at your premises.

Yes. With CSIRT Gold or CSIRT Platinum, you will receive 2 emergency cards and an annual certificate for compliance documentation.

The CSIRT is compliant with the requirements of ISO 27001, NIS 2, DORA and IEC 62443-4-1.

Yes. We operate a state-of-the-art IT forensic and technology lab for investigations and more complex cases.

Non-urgent security inquiries, reviews and consultations are billed at a reduced daily rate.

You only pay for services you’ve requested and that have actually been provided. There are no minimum purchase requirements or retainer fees.

Yes. Collaboration with your internal IT team and existing service provider is specifically designed to help you quickly return to normal operations.