Skip to content
DFIR — Incident Response

When the attack has already happened,
what matters is knowing exactly what occurred.

Containment, forensic analysis, full report and recommendations to prevent it happening again. Activated when you need it. No upfront hour packages that you hope you'll never use.

Why the usual model doesn't work

Nobody wants to pay for something they hope
they'll never need.

Most companies offering incident response sell a bank of days. Ten hours, twenty hours — paid upfront, drawn down every time something happens.

The problem is that if nothing happens, those hours expire or renew. And if something serious does happen, ten hours aren't enough and you have to buy more — at the worst possible moment, when you're already in the middle of an incident.

It's a model designed for the provider, not the client.
"We bought ten days two years ago. We never used them. This year we renewed them again."
Usual model
Pay upfront
  • Bank of hours purchased before anything happens
  • If you don't use it, you lose it or renew it
  • If the incident is serious, the hours run out
  • Hourly rate at the worst possible moment
RedLemon
Pay only if it happens
  • A one-off activation fee to have the service available
  • Zero additional cost if nothing happens
  • Per-incident pricing — not per hour, not upfront
  • Cost agreed before anything happens, without urgency
The process

One activation fee.
The rest, only if you need it.

No annual day renewals, no volume commitments. Covered from the moment you sign.

01
When you sign
Service activation
A single activation payment to have the service available. We define contacts, emergency access and the activation procedure. From that point on, you're covered.
02
If an incident occurs
Activation and containment
You contact us. That same day we get remote access to the affected systems. If the attack is still active and you don't have EDR, the first phase is containment — stopping propagation before analysing anything.
03
Analysis
Forensics and investigation
Review of logs, affected systems, entry vectors and attack timeline. We work with what's available — if the logs weren't retained, we say so clearly.
04
Close
Report and recommendations
A full report with everything we've been able to determine, and concrete recommendations to prevent it happening again. Cost is per incident, agreed before it occurs.
Forensic analysis

We don't just put out the fire.
We analyse why it burned.

Containment stops the attack. Forensic analysis answers the questions that matter afterwards: how they got in, when they got in, what they did while they were inside, and what they left behind.

Without that information, the incident is closed but the problem remains open. Most companies that suffer a ransomware attack suffer another within twelve months — because they patched the visible hole but didn't find the real one.

  • Entry vector — how they accessed your systems
  • Attack timeline — what happened, in what order, how long they'd been inside
  • Scope — which systems were affected and to what extent
  • Compromised data — what information was exposed, if it can be determined
  • Concrete recommendations — what needs to change to prevent it happening again
An honest note: the depth of the analysis depends on the information available. If the logs weren't retained or the attacker deleted them, there are things we won't be able to determine. We will always be clear about what we were able to conclude and what we weren't.
The first phase

First stop the attack.
Then understand what happened.

If you have EDR contracted with us, containment is already covered — the system automatically isolates compromised endpoints and our engineers manage the response from the very first moment.

If you don't have EDR, the first phase is evaluating how to contain the incident based on the specific case. There's no standard response because no two incidents are the same — but the goal is always the same: stop propagation before starting the analysis.

Fit with the managed SOC

If you already have the SOC,
the analysis is faster.

You don't need to be a SOC client to contract incident response coverage. It's available for any company.

That said, if you already have the managed SOC with us, we know your infrastructure, we have access to your historical logs and the forensic analysis is more complete and faster. The SIEM has already been recording what was happening — the forensics start from there.

See Managed SOC →
Next step

Better to arrange it before you need it.

Tell us how your security is set up right now. An engineer will explain how the service fits your situation and what it would cost if an incident occurred — without urgency, without already being in the middle of one.