Incident ResponseThe first hour of an incident: six steps before the responders arrive
What to do, and what not to touch, in the first hour after you notice an attack. A short checklist for the people who are on site.
We find the weakness before the attacker does.
We test you through an attacker’s eyes, see the campaign aimed at you before it lands, and when an incident hits we spend the first hour with you. Every finding comes with evidence and is tracked until it is closed.
Who we are
Security is not bought once. It is built every day.
Cyberattacks do not stop at borders, so neither does the defence. Falcon Security is built for the whole world: whichever country and time zone you work in, the standard is the same. We do not write into a contract what we cannot do, which is why what we write gets done.
- 01One accountable team: audit, response and training from the same people. “That is another department’s job” is never the answer.
- 02Ours first: every product protects our own infrastructure before it is offered to a client.
- 03Three questions answered: what was found, what was closed, what is still open. Every report follows that order.
Why Falcon
Built on trust and results
Those who choose us notice it in the first week.
- 01
A team that knows you
Every client gets a dedicated engineer who knows your infrastructure, your people and your history. During an attack no time goes to introductions: one call, and the work begins.
- 02
We see both sides
BugOne researchers attack, the response team defends, and both live in one house. We know from the inside how a weakness is found and how it is used.
- 03
Results, not reports
Every finding is confirmed by exploitation, rated by impact and tracked until it is closed. A retest after the fix is part of the service.
Problem and solution
Which one is yours right now?
Six typical situations. Each has one concrete answer: who, what they do and when.
- 01
You are under attack right now
A server is encrypted, accounts are in someone else’s hands. Every minute adds to the damage.
Solution
Incident Response: containment within the first hour, with evidence preserved
Open the solution: Incident Response: containment within the first hour, with evidence preserved - 02
There is a weakness, location unknown
A scanner finds what is known; a logic flaw is found by a person, the attacker or us.
Solution
Penetration testing, then BugOne: hundreds of researchers keep looking
Open the solution: Penetration testing, then BugOne: hundreds of researchers keep looking - 03
Employee passwords are already for sale
Infostealer logs reach a forum within hours. Most companies learn this after the attack.
Solution
Data Breach Check: domain-wide check, immediate alert on a new leak
Open the solution: Data Breach Check: domain-wide check, immediate alert on a new leak - 04
One e-mail, and the money is gone
Phishing needs no malicious file: one “urgent” e-mail in the CEO’s name is enough.
Solution
Falcon Academy: phishing simulation and measurable awareness
Open the solution: Falcon Academy: phishing simulation and measurable awareness - 05
The attacker knows about the attack first
Generic feeds do not show the campaign aimed at your sector; they have no sensors where you operate.
Solution
Threat Intelligence: campaigns by sector and region, an IOC feed into your SIEM
Open the solution: Threat Intelligence: campaigns by sector and region, an IOC feed into your SIEM - 06
Audit is near, gaps are unknown
Law 547, PCI DSS or ISO 27001 is coming. The documents exist, the real state is unclear.
Solution
Compliance audit: gap analysis, remediation plan, closed before the review
Open the solution: Compliance audit: gap analysis, remediation plan, closed before the review
Ecosystem
01 / 05
One team, one standard, five products
01 / 05
Incident Response
- 24/7
- Containment
- Forensics
- Recovery
During an incident the most expensive thing is time. We quickly establish what happened: scope, affected systems, whether the attack is ongoing, and stop the spread with evidence preserved.
- Incident Response: During an incident the most expensive thing is time. We quickly establish what happened: scope, affected systems, whether the attack is ongoing, and stop the spread with evidence preserved. (incident.uz)
- BugOne: Hundreds of vetted researchers test your application continuously, and you pay only for confirmed findings. Triage, noise and payout paperwork stay on our side; you receive a ready, prioritised report. (bugone.uz)
- Threat Intelligence: You are the first to know about threats aimed at your sector and your domain: regional campaigns, leaked employee accounts, brand clones. Indicators land straight in your security tools: not an alert, a ready action. (threat-intel.uz)
- Data Breach Check: Threat Intelligence watches the threat; Data Breach Check answers one question in a second: is your e-mail, phone or domain in a breach. Free and anonymous for citizens; for companies, continuous domain monitoring and an immediate alert on a new leak. (breach.uz)
- Falcon Academy: We train the staff of companies and government bodies: employees learn to spot phishing, technical teams get pentest, SOC and incident response, on the example of your own infrastructure, with results measured in numbers. (falcon-academy.com)
Services
08From a one-time check to an ongoing partnership
Adapts to your maturity: from a single pentest to 24/7 response and regular retests.
- 01
Penetration testing
Web, mobile, APIs and external infrastructure; every finding confirmed by exploitation.
Learn more: Penetration testing - 02
Security audit
A full assessment of the external surface, configurations, access rights and processes.
Learn more: Security audit - 03
Incident response 24/7
Call, containment, forensics and recovery in a pre-agreed order.
Learn more: Incident response 24/7 - 04
Digital forensics
Entry point, timeline and affected data in a report fit to serve as evidence.
Learn more: Digital forensics - 05
Bug bounty program
Through BugOne: scope, reward table, triage and payouts handled by us.
Learn more: Bug bounty program - 06
Threat intelligence subscription
APT profiles for your sector, an IOC feed and dark web monitoring, connected to your SIEM.
Learn more: Threat intelligence subscription - 07
Compliance and risk
Law 547, PCI DSS, ISO 27001: gap analysis, policies and gaps closed before the audit.
Learn more: Compliance and risk - 08
Corporate training
Phishing simulation for staff, pentest and incident response sessions for the tech team.
Learn more: Corporate training
Three things that never change in our work
Whatever the service, the report is built to one measure.
- 01
Findings confirmed with a PoC
Every vulnerability comes with reproduction steps and an impact rating, not a theoretical list.
- 02
Two reports
Technical for engineers, and in decision language for management.
- 03
Retest
After the fix, closed findings are confirmed and the ones still open are recorded.
Process
How we work
Transparent, measurable and repeatable at every stage. The scope is confirmed in writing, the result is documented.
- 01
Scope
We agree what is tested: domains, systems, applications, integrations. NDA and boundaries confirmed in writing.
- 02
Analysis
Automated and manual testing: external surface, infrastructure, applications, user behavior. Every finding is confirmed by exploitation.
- 03
Report and fix
A technical report ranked by priority and a management summary. We work alongside your team during remediation.
- 04
Retest and monitoring
Closed findings are confirmed. Then 24/7 response, threat intel and regular retests.
Every stage is confirmed in writing
Blog
Read it before you need it
Checklists and explanations from our own practice.
- Incident Response
Bug BountyBug bounty or penetration test: which one comes first
Both find vulnerabilities, but they answer different questions. How to choose, in what order to run them and how to tell that you are ready for a bug bounty.
Data BreachYour password appeared in a data breach: what happens next
How a leaked password travels from an old forum to your corporate mail, why changing it in one place is not enough, and what a person and a company should do.
Let’s start
Start with a free external check
Give us your domain and we return a first report on your external attack surface and leaked accounts. Nothing is installed, nothing is blocked; the scope is agreed based on the result.
- Subdomains, open ports and expired certificates
- Corporate accounts found in breaches
- The three most important issues and where to start