Restoring a backup… that is compromised
The restored backup dates from after the intrusion. You think you are starting again clean: you are reinstalling the attacker. You must first date the compromise.
Galyct Pro · Remediation & rebuilding
Remediation after an incident
After the emergency phase, remediation covers eradicating the attacker’s access, rebuilding and hardening. Every step is recorded in the platform: actions, owners, timestamps and deliverables. Tracking and evidence are the job of Galyct Pro; the technical work is carried out with your IT team or your service provider, and the firm can step in on a quotation basis. See the firm’s remediation engagement.
Understand the risk. Take back control. Stay the course.
Is a crisis still in progress? Stabilise first, without destroying the evidence →
01 · THE THREE CLASSIC MISTAKES
Three traps after an incident: remediation exists to avoid them.
Haste costs more than the attack itself. Three reflexes, reasonable on the face of it, leave the door open. Remediation carried out in the right order neutralises them.
Changing the passwords… and nothing else
Access is reset while the persistence mechanisms stay in place: the attacker’s scheduled tasks, mail rules, keys and hidden accounts.
Declaring the incident closed… too soon
The page is turned without the entry point having been identified. The same flaw is exploited again a few weeks later, often by the same actor.
02 · HOW WE LEAD REMEDIATION
Four stages, in order: you do not clean up what you have not understood.
Remediation begins once the situation has been assessed and stabilised, never in haste. Each stage is carried out with your team and recorded in the platform.
1Map the compromiseWhat is affected, since when, and how they got in. We establish the real scope before acting: without this map, you are cleaning up blind.
2EradicateRemoval of the attacker’s access, persistence mechanisms, malicious accounts and rules. We cut off every way in, not just the most visible one.
3RebuildRestoration or rebuilding of the affected systems, reset of secrets, verification that the backups themselves are clean.
4Harden & verifyFixing the entry flaw, hardening configurations, a final check and a monitoring period to confirm that everything is clean again.
03 · WHAT YOU GET
Usable deliverables, not just an “it’s sorted”.
Remediation leaves a record you can use with your management, your insurer and the authorities, and prepares what comes next so that the incident does not happen again.
Timestamped remediation log
Every action dated and recorded in the platform: a timestamped log that can be exported for the insurer as well as the regulator.
Management & technical report
Two readings of the same work: the summary for decision-making, the detail for the IT team, with the list of vulnerabilities fixed.
30 / 60 / 90 hardening plan
A costed, prioritised trajectory, and a natural transition to ongoing steering: so that it does not happen again.
04 · PLATFORM + FIRM
The software records. The experts lead.
Two complementary roles, one French brand. You keep control and visibility at every stage of the remediation.
The software
The Galyct Pro platform
It records decisions and hosts the remediation log. You follow progress in real time, and every action remains timestamped and defensible.
- Timestamped log & evidence register
- Progress tracking across the four stages
- Transition to ongoing steering
The firm
The experts who step in
They run the operations with your IT team or your service provider: map, eradicate, rebuild, harden. The decision remains yours, an informed one.
- Work scoped with your teams
- Every action proportionate and justified
- Clear reporting, for management and technical staff
05 · OUR HONESTY
What we deliver, what we do not promise.
Serious remediation starts with what it refuses to sell you. We would rather be clear about what no provider can guarantee.
What we deliver
Remediation carried out in order, every action recorded and justified, a timestamped, exportable log and a hardening plan that is followed through. We work with your teams and never ask you for your passwords or codes.
What we do not promise
No guaranteed recovery of encrypted data. No ransom payment, and no advice to pay one. No “big bang” that reinstalls everything by default: remediation that is proportionate, justified and documented.
“Sorted” does not mean “clean”
As long as the entry point, the persistence mechanisms and the attacker’s access remain, the organisation is still compromised. Remediation is what turns a contained incident into a system that is genuinely clean, and hardened against the next attempt.
Start again on a sound footing.
Has an incident just been contained? Talk to an expert to scope the remediation. Planning ahead? See the platform in your context with a demo.