Compromised account or system
A hijacked mailbox, an infected workstation or server: the attacker has a way in that must be closed before anything is restarted.
The firm · Remediation & rebuilding
Fix the causes and reduce the risk of it happening again.
After the assessment, we prioritise corrective actions according to exposure, urgency and effort. Changes are documented and, where the scope allows, verified after implementation.
First conversation confidential, no commitment. We never ask for your codes.
01 · WHEN REMEDIATION IS NEEDED
You don’t switch back on what you haven’t cleaned up.
A compromised account or mailbox, an infected workstation or server, ransomware, a detected intrusion, a lingering doubt after an incident “resolved” too quickly. Remediation comes in once the situation has been assessed and stabilised, never in a rush.
Ransomware or intrusion
Encrypted files, forced access, suspicious movements: the threat remains active until its presence has been eradicated.
A lingering doubt
An incident “resolved” too quickly often leaves traces behind. Better to remediate properly than to live through the same intrusion again.
02 · THE FOUR-STAGE METHOD
Map, eradicate, rebuild, harden & verify.
Remediation is not a blind reinstallation. It is an ordered sequence in which each step builds on the previous one, with the evidence preserved at every stage.
1Map the compromiseWhat is affected, since when, and through which way in. We don’t clean up what we haven’t understood.
2EradicateRemoval of the attacker’s access, persistence mechanisms, and malicious accounts and rules.
3RebuildRestoration or rebuilding of the affected systems, reset of secrets, verification of backups.
4Harden & verifyFixing the entry points, hardening configurations, a final check and a monitoring period.
03 · FOR WHOM
Businesses and individuals, two ways in.
The same demand for method, two frameworks adapted to who you are and to what is affected.
Businesses
An engagement framed with your teams.
An engagement carried out with your IT team or your provider, a timestamped remediation log, and a final report that can be used with your insurer, your management and the authorities.
- Carried out in coordination with your in-house or outsourced IT
- A timestamped, usable remediation log
- Final management and technical report
- On quotation, via Galyct Pro
Individuals
Guided remediation, step by step.
For individual victims, clear support and a clear price, from initial securing through to documented remediation.
- Securing & guided remediation from €299
- Documented remediation from €499
- Support in plain language
- Via Galyct Perso
04 · OUR HONESTY
What we deliver, what we do not promise.
Serious remediation is proportionate and justified. We prefer to be clear about what we commit to, and about what no honest provider can promise.
What we deliver
Every action is proportionate, justified and documented. We preserve the evidence at every step, we eradicate before rebuilding, and we fix the entry point rather than work around it, without ever asking for your codes.
What we do not promise
No one can guarantee the recovery of encrypted or destroyed data. We do not pay ransoms and never advise paying one without a legal framework. We do not “reinstall everything” by default: every action is proportionate and justified.
Clean up before restarting
Until the attacker’s access, persistence mechanisms and entry point have been dealt with, the organisation remains compromised. Restarting without remediation means reopening the door; remediation carried out in the right order is what stops the incident from happening again.
Let’s start again on sound foundations.
A first conversation with an expert about your incident: confidential, no commitment, no sales pitch. We frame the remediation at your pace, preserving the evidence.