Services

We collect the logs from your devices, firewall, email accounts and cloud in a platform dedicated to your company. An analyst validates every alert, assigns it a priority and reports the finding and the actions under way.

If you already have an antivirus or EDR, its alerts are added as one more source. Response actions run only if you authorized them in writing beforehand.

Coverage and response times depend on the plan and are set in the contract.

What you get

• A monthly report.
• A written record of every significant incident.

Not included

• An antivirus or EDR. We don’t replace it.
• Remediation on your systems.*

* Available as an additional service, subject to an agreed scope and access.

A review of the state of your security, mapped to a recognized controls framework. It covers the domains we agree on, from identity and email to backups and cloud.

It is not a penetration test. We review configurations and evidence, without intrusive testing. Any sensitive activity happens only with your written approval.

There is an Express version, with a fixed scope, for small companies.

What you get

• An executive report with the main risks and priorities.
• A technical report with findings and recommendations.
• A 30, 60 and 90-day plan.
• A closing meeting.

Not included

• Implementing the fixes.*
• Penetration testing.

* Available as an additional service, subject to an agreed scope and access.

Incident response hours reserved for a year, with a committed start time. When you suspect or confirm an incident, you activate it and an analyst starts working the case with you.

The work includes the initial analysis, containment recommendations, evidence analysis and an incident report.

If the year goes by without incidents, the hours can be used for preventive work: tabletop exercises, threat hunting or a review of your response plan.

Not included

• Court expert work or reports with legal standing.
• Remediation or system restoration.*
• Negotiating with attackers or paying ransoms.

* Available as an additional service, subject to an agreed scope and access.

For IT companies that support small businesses and want to offer security monitoring without building their own SOC. You are our client: you contract the service, put your brand and your price on it, and bill your client.

We run the monitoring and escalate each case to you with what we found and what we recommend. You keep the relationship with your client, who receives the reports under your brand.

For more information, write to us.

Not included

• Direct contact between The Khromas and your clients.
• Remediation on your clients’ systems.