- Average response time
- < 30 min
- Incidents contained
- 420+
- Data recovered without paying ransom
- 96%
- 365 days a year
- 24/7
What we solve
Whatever the attack, we have seen it before.
Our team has handled hundreds of real incidents in banking, healthcare, industry and the public sector. We know what to do every minute.
Ransomware
Encrypted files and a ransom note. We contain, eradicate and restore.
- Odd file extensions
- Ransom note
- Slow servers
CEO fraud and fake invoices
Transfers to fraudulent accounts. We work with your bank in the first hours.
- IBAN change
- Urgency and secrecy
- Look-alike domain
Data breach
Customer data exposed. We scope the breach and notify the regulator within 72 h.
- Data on forums
- Extortion
- Mass access
Hacked email and accounts
Microsoft 365 or Google Workspace compromised. We kick the intruder out and lock the door.
- Forwarding rules
- Foreign logins
- Emails you never sent
Systems down or DDoS
Website, ERP or production stopped. We prioritise what costs you most.
- Site unreachable
- Production halted
- Abnormal traffic
Something feels off
Antivirus alerts, an employee who clicked, a warning from the bank. We check it.
- Strange alerts
- Phishing click
- External warning
How we respond
From the call back to normal, in hours.
A method proven across hundreds of incidents, aligned with NIST SP 800-61 and ISO 27035. You always know what we are doing and why.
- 01
Minute 0
Call and triage
A senior analyst assesses the situation and tells you what to do and what not to touch.
- 02
Minute 30
Containment
We connect remotely, isolate affected machines and cut off the attacker.
- 03
Hour 24
Eradication and recovery
We remove persistence, restore clean backups and get your business running again.
- 04
Hour 72
Report and notifications
Forensic report, notifications to regulators, CSIRT and insurer, and a plan so it never happens again.
Why Custodia
An expert agency, not a call centre.
When you call, you speak directly with the person who will resolve the incident. No tickets, no escalations, no waiting.
Certified team
- ISO 27001
- ENS High
- GCFA
- OSCP
- CISSP
- CREST
- 01
Senior analysts from minute one
Over 10 years of average experience in incident response and forensics.
- 02
Fixed-price quote
You get a price before we start. No overtime, no surprises on the invoice.
- 03
We work with your insurer
We coordinate with your cyber policy so the cost is covered.
- 04
Court-ready evidence
Forensic chain of custody for police reports, claims and legal proceedings.
The difference
Why your IT provider is not enough.
| — | CustodiaCustodia | IT provider | Waiting |
|---|---|---|---|
| Response in under 30 min, 24/7 | |||
| Forensic specialists | |||
| Ransom negotiation and handling | |||
| On-time regulator and CSIRT notice | Sometimes | ||
| Report accepted by your insurer | |||
| Risk of fines | Minimal | Medium | Up to €10M |
Real cases
Companies that called us on their worst day.
Manufacturing · 450 staff
58 h
back to production
“At 11 pm on a Friday the whole plant was encrypted. First thing Monday we were producing again. We did not pay a cent of ransom.”
Head of operations Distribution · 120 staff
€240k
recovered
“We paid a fake €240,000 invoice. Custodia coordinated with the bank that same afternoon and we got the money back.”
CFO Healthcare · 3 clinics
€0
in fines
“A leak of patient records could have sunk us. They contained it, notified the regulator on time and the case closed with no fine.”
Managing director
FAQ
What people ask us on the first call.
Will you help even if I am not a client?
Yes. Most companies that call us about an incident are not clients yet. We respond just as fast.
How much does it cost?
The first assessment is free. Then we give you a fixed-price quote based on the scope, before we start. If you have cyber insurance, it usually covers the cost.
Should I pay the ransom?
We advise against it: it does not guarantee recovery and marks you as a target. In 96% of our cases we recover the data without paying.
Do you need to come to our offices?
Containment is done remotely from minute one. If needed, we send a team on-site anywhere in Spain and Europe.
Is it confidential?
Completely. We sign an NDA before we start and never share information without your authorisation.
What should I do in the meantime?
Disconnect the affected device from the network, but do not switch it off. Do not delete anything, do not pay and do not alert the attacker. We will guide you from there.
Every minute counts
Talk to an analyst now.
The sooner we act, the less data you lose and the less it costs. The first call is free and with no commitment.
- No commitment
- NDA from minute one
- All of Europe