Your stack is built.
Your IR team shouldn't have to be.
You've built your security practice. Porthas extends it — elite DFIR and ransomware response delivered white-label under your brand, and Lynx to make your existing stack smarter. No new headcount. No ripping out what you have.
Two things we do for your practice
We fit into what you already do — filling gaps in DFIR capacity and making your existing security stack smarter.
White-Label DFIR & Ransomware Response
When a client is hit, your team calls us — we deploy, contain, recover, and remediate. The client sees your brand at every step. You maintain the relationship. We provide the expertise.
- Fully co-branded or white-labeled delivery — your name throughout
- 3,000+ incidents resolved by the Proven Data team since 2011
- DFIR report, chain of custody, and legal-ready documentation
- Ransomware negotiation and decryption where applicable
- Insurance panel approved — streamlines your client claims process
Bring Your Stack to Lynx
You already have an EDR, a SIEM, maybe email security. Lynx doesn't replace them — it ingests their signals and applies AI correlation and triage across your entire stack.
- Ingest signals from your existing tools into one triage engine
- AI layer correlates cross-source events — radically fewer false positives
- Add missing modules (ITDR, ASM, supply chain) on an as-needed basis
- Optional human SOC layer for escalation and overnight coverage
- Resell Lynx access as an add-on to your own clients
What happens when your client gets hit
You make one call. We deploy under your brand. Your client never knows the difference.
Immediate Response
24/7 emergency line — live answer, no queue. Initial triage begins on first contact.
Contain & Investigate
Lynx agent deployed remotely. Network isolation and containment within 22 minutes on average. Forensic evidence preserved in parallel.
Recover & Decrypt
80%+ recovery without ransom payment. Where decryption is unavailable, clean restore from immutable backups.
Remediate & Harden
Root cause identified, entry vector closed, gaps patched. Full DFIR report for insurance and legal proceedings.
Your tools don't change.
Your signal quality does.
Lynx ingests telemetry from the tools you already run — EDR, email security, SIEM, identity providers — and layers AI correlation on top. Enable additional modules where you have coverage gaps. One triage engine across your entire stack.
Choose how you work with us
Most MSSPs start with white-label delivery and grow into operational partnerships as the engagement deepens.