Malware that encrypts your files for payment. Keep offline backups, patch fast, limit admin rights, train staff, and use EDR.

• No vendor can guarantee that. Our job is to reduce likelihood, detect fast, and minimize impact with tested response playbooks.

The endpoint sensor is lightweight (typically 1–3% CPU during scans). It monitors security events—not personal content. BYOD devices follow a minimal-data policy.

For Critical (P1) events we alert you immediately via phone/SMS/email and start response. High (P2) within 1 hour. Lower-severity issues roll up into daily or weekly summaries.

Viewing plain text is usually safe, but links/attachments are dangerous and images can track you. Don’t click or download unless you’re sure.

Our SLAs are measured within plan coverage hours (Mon–Fri 08:00–17:00 EET). Alerts detected outside coverage are queued and handled in the next coverage window unless an after-hours arrangement is in place.

Notify means we contact your designated security contact(s) via email/ticket (and phone call if VIP alerting is active). Containment starts means we begin approved actions (e.g., block/isolations) after confirmation or via pre-approved playbooks where applicable.

We continuously collect security telemetry, but human response and SLA commitments are provided within the plan’s coverage hours unless an after-hours arrangement is added.