Managed SOC, Incident Response, Risk Assessments & Security Training

ITgalya Monitor, investigate and respond to cyber threats — without building an internal SOC

ITgalya adds a professional cybersecurity layer alongside your existing IT function: monitoring, alert investigation, risk assessments and incident response.

Check what is missing in your security programme Talk to a cybersecurity professional

Managed SOC

Continuous monitoring of your environment, detection of suspicious activity and handling of alerts — a security layer alongside your existing IT function.

Incident Response

Rapid, professional response to security incidents: containing the threat, forensic analysis of what happened, and restoring operations.

Cyber Risk Assessment

Mapping the risks in your environment, finding the security gaps, and setting out clearly what to fix first.

// find your starting point

Not sure which service you need?

Start with the situation that sounds most like yours — not with a product name.

“We have IT, but no one continuously monitors security”

Add continuous alert triage and investigation without building an internal SOC.

Explore Managed SOC →

“We do not know where the gaps are or what to fix first”

Map the environment, prioritise the risks and turn them into a practical roadmap.

Explore Risk Assessment →

“We are checking what Amendment 13 means for us”

Map technical and organisational privacy-security readiness without pretending it is legal advice.

Check readiness →

“There is suspicious activity or an incident right now”

Move from uncertainty to containment, investigation and a controlled response path.

Incident Response →

Still not sure?

The 2-minute self-assessment gives you a direction without asking for contact details first.

Start assessment

// about the company

What is ITgalya?

ITgalya is an Israeli information security provider offering Managed SOC, Incident Response, cyber risk assessments and security training to organisations.

Managed SOC: Continuous monitoring of the environment, and triage of what it surfaces.
Incident Response: Containing a live incident, working out what happened, and restoring operations.
Cyber Risk Assessment: Finding the gaps, and setting out what to fix first.
Security Training: Preparing the people, from awareness to response drills.

More about the company on the about page, or see every service in detail.

// how we work

Speed is part of the service

In an incident, the time between the alert and the answer is the difference between a contained event and real damage. Shortening it is an engineering problem, and we treat it as one.

Less manual work in the way

Collection and first-pass analysis are the slowest part of any investigation and the least dependent on judgement. Automating them is what frees the time that judgement actually needs.

Tooling built for our own work

We build the tools we use ourselves rather than adapting our process to what a product happens to support, and we combine them with automation and AI where that genuinely shortens the path.

Professional time where it counts

The result is not an automated answer. It is an experienced analyst reaching the decision sooner, with the material already in front of them.

// what we do

The capabilities behind the services

Continuous monitoring, real-time threat detection and deeper analysis when something needs investigation.

Monitoring and detection

Collecting logs and alerts from systems, networks and identities, filtering noise and identifying activity that departs from normal.

Forensic analysis

Examining memory, files and network traffic to establish what happened, what was affected and how the activity progressed.

Evidence and reporting

Collecting and preserving evidence and producing a report that explains the findings in terms the organisation can act on.

In practice, that includes:

Continuous monitoring and suspicious-activity detection
Memory, file and network analysis
Network traffic and log analysis
Evidence collection and preservation during an incident

// our services

Professional cybersecurity services

Four core service lines: security operations, incident response, risk assessments and cyber training.

Managed SOC

Continuous monitoring of your environment, detection of suspicious activity and handling of alerts — a security layer alongside your existing IT function.

Incident Response

Rapid, professional response to security incidents: containing the threat, forensic analysis of what happened, and restoring operations.

Cyber Risk Assessment

Mapping the risks in your environment, finding the security gaps, and setting out clearly what to fix first.

Security Training

Professional security training: staff awareness, incident response drills and technical instruction.

Reviewing Amendment 13 readiness?

The separate Privacy & Security Readiness review maps people, process, technology, access, monitoring and incident readiness.

Explore readiness →

// by sector

What matters in your sector

The same service lines, read through what your sector actually stands to lose and what it has to be able to show.

Law firms

Client files, professional privilege and trust funds — an environment where a leak is both a security incident and a breach of privilege.

Financial services

Money, identities and permissions — an environment where the regulator and the attacker are looking at the same systems.

Healthcare

Medical information is the most sensitive category there is — and here system availability is a clinical question, not an operational one.

// Why ITgalya?

Our advantages

Alongside the operational work, ITgalya develops internal capability and automation intended to improve the quality of detection and investigation over time. More on our R&D.

Technical Depth

Hands-on monitoring, investigation and response work — across endpoints, identities, Microsoft 365 and cloud environments.

Availability Agreed Up Front

How much availability there is, and how to reach us during an incident, are agreed with each client in advance — so it is clear who to call and when, rather than something to work out mid-incident.

Speed, From Our Own Tooling

We build our own internal tooling, combining automation and AI, to cut the manual work out of collection and analysis — so professional time goes into decisions rather than into gathering data.

Complete Discretion

Absolute confidentiality and discretion in every engagement.

// next step

Not sure what the right next step is?

Use the short assessment to identify the areas worth reviewing, or tell us what changed and we will start from there.

Take the 2-minute assessment Talk to a cybersecurity professional

Do not send passwords, credentials, API keys, logs or sensitive incident material through the web form.