Frequently asked questions

We are a technology company founded in 2010. We build 25 solutions of our own, provide cybersecurity, Microsoft cloud, datacenter, VPS, hosting and professional services, and run it all with Lía Autonomous, our AI platform.

It is our AI engineering and operations platform. It detects problems, fixes them, tests the changes and ships them only when they pass verification. Sensitive actions require human approval. In 7 months it resolved 12,947 cases.

All 25 SGS solutions, including SGS Offensive and SGS WebMon, are built in-house. We are also a channel partner for Microsoft, Strike, Xcitium, Whalemate, ESET, Kaspersky and Fortinet, among others.

We have offices in Costa Rica, the Dominican Republic, Panama, Mexico and the United States. Operations, the SOC and the datacenter are in Costa Rica.

Write to us from the contact page or on WhatsApp. Every proposal is tailored to your company, which is why we do not publish fixed prices. A specialist replies within 24 business hours.

In the Client portal, where you see your services, contracts and support cases.

Each covers one part: SPF authorizes servers, DKIM signs the message and DMARC sets the policy and aligns both. Without the three aligned, spoofing protection is incomplete.

No. WebMon works on top of your current provider — Microsoft 365, Google Workspace or your own server — monitoring your authentication and filtering mail, without migrating your mailboxes.

Monitoring starts once the reporting records are published; DMARC reports arrive daily and give visibility within the first week. Moving the policy to quarantine or reject is done gradually and safely.

Yes. SGS deploys and operates WebMon, monitors and responds from its 24/7 SOC on its own datacenter in Costa Rica, as part of Security 360°.

They are the three DMARC policies: none only monitors, quarantine sends suspicious mail to spam and reject blocks it outright. The recommendation is to start at none and advance using report data.

No. DMARC relies on SPF and DKIM: it checks that at least one passes and aligns with the From domain. Without SPF and DKIM correctly configured, DMARC has nothing to evaluate.

It can, if there are legitimate sources left unauthenticated. That is why WebMon first identifies and authenticates all your sources in none mode, and only then raises the policy gradually.

WebMon receives and processes your aggregate reports, translates the XML into clear sources, detects abuse and guides you to p=reject, backed by the SGS 24/7 SOC in Costa Rica.

The SPF standard allows a maximum of 10 DNS queries when evaluating the record. Exceeding it produces a permerror that invalidates your SPF; that is why flattening unnecessary includes helps.

No. The domain must have a single SPF record; two SPF TXT records cause a permanent error. All mechanisms must be combined into one line.

Not entirely: SPF validates the envelope domain, not the one the user sees in the From. That is why it is combined with DKIM and enforced with DMARC to cover the visible address.

WebMon checks the syntax, counts the lookups, cross-references your includes with the real DMARC sources and suggests the correct record, supported by the SGS 24/7 SOC in Costa Rica.

It is the label identifying which public key to use; it is published as selector._domainkey.yourdomain. It allows several active keys and eases rotation without interrupting sending.

A good practice is to rotate them periodically, typically every few months, publishing a new selector before retiring the previous one so signatures in transit are not broken.

It is usually due to badly published public keys, a nonexistent selector, or intermediaries that modify the header or body after signing. WebMon identifies which of these causes applies.

WebMon validates your signatures, verifies selectors and key length, and alerts you when to rotate, backed by the SGS 24/7 SOC on its own datacenter in Costa Rica.

Yes. BIMI requires your domain to have DMARC at a quarantine or reject policy. Without that enforcement, inboxes will not show your logo even if you publish the BIMI record.

The Verified Mark Certificate attests that your brand owns the rights to the logo, usually via a trademark. Several inboxes, such as Gmail, require it to display the logo.

Typical causes are DMARC without enforcement, a logo that does not meet the SVG Tiny P/S profile, or a missing or expired VMC. WebMon checks each requirement and tells you what to fix.

WebMon confirms your DMARC, validates the SVG logo and VMC certificate, and publishes the correct BIMI record, with support from the SGS 24/7 SOC in Costa Rica.

No. MTA-STS protects SMTP transport encryption, while DMARC, SPF and DKIM authenticate the sender. They are complementary layers of the same email security posture.

In testing, failures are reported via TLS-RPT but mail is still delivered; in enforce, if TLS does not meet the policy, plaintext delivery is rejected. It is best to start in testing and then harden.

TLS-RPT (RFC 8460) makes sending servers deliver you daily reports on the success or failure of encryption when delivering to your domain, giving you visibility of issues before they affect mail.

WebMon continuously verifies the DNS record and the HTTPS policy, processes your TLS-RPT reports and watches the MX certificate, alerting you to any change or encryption failure.

SMTP was designed in the 1980s without sender authentication, so the "From:" field can be written freely. SPF, DKIM and DMARC are the layers added later to validate the origin.

DMARC needs SPF or DKIM to work: it defines what to do when authentication does not align with the "From:" domain. In a reject policy, spoofed emails are discarded before reaching the recipient.

Yes. A frequently spoofed domain builds up negative reputation, and without proper authentication your legitimate mail may land in spam. A well-configured DMARC protects both brand and deliverability.

WebMon continuously monitors your SPF, DKIM and DMARC records, processes aggregate reports and alerts you to spoofing attempts or any change that weakens your authentication.

Spoofing forges the sender address; phishing is the deception that gets the victim to act. They often go together, but spoofing is stopped with authentication and phishing with content filtering and threat intel.

No: it complements it. The gateway reduces how many malicious emails reach the user, but awareness remains key. Effective defense combines technology and people.

DMARC, with SPF and DKIM, prevents anyone from sending phishing using your domain as the sender. The gateway handles inbound phishing; authentication protects your domain as a brand abused by attackers.

WebMon inspects inbound mail with its anti-phishing gateway, cross-checks senders and URLs against up-to-date threat intelligence and alerts you to new campaigns or changes in your email security posture.

Because it usually carries no malware or malicious links: it is just a believable text email. With no obvious technical payload, many filters let it through, which is why sender authentication is key.

DMARC stops BEC that directly spoofs your domain. On its own it does not cover look-alike domains or compromised accounts, which is why it is combined with filtering, threat intel and payment verification processes.

Because BEC lives on trust in the sender. If your domain can be authenticated and verified, a forged email in your name is rejected, and payment decisions stop relying on appearances.

WebMon monitors your domain authentication with DMARC, SPF and DKIM, filters emails with fraud patterns, watches look-alike domains with threat intel and alerts you to impersonation attempts.

You can start where you need it most — pentesting, endpoint containment or SOC — and add fronts over time. Security 360° grows in value as the pieces work together.

No. SGS operates as your managed security team: we deploy, monitor and respond from our 24/7 SOC. If you already have a team, we complement it.

From our own datacenter in Costa Rica, with 24/7 NOC/SOC monitoring and coverage across Latin America.

Pentesting with Strike reveals where an attacker can get in; ZeroDwell containment and Xcitium EDR close those paths, and the SOC keeps watch that they stay closed.

Antivirus protects one device; the SOC continuously watches your whole organization, correlates events and responds to incidents with a human team around the clock.

On SGS's own datacenter in Costa Rica, with coverage for clients across Latin America.

Yes. The SOC operates alongside ZeroDwell containment and Xcitium EDR, so detection is paired with real neutralization at the endpoint.

No. SGS runs the SOC as a managed service, so you get 24/7 monitoring and response with or without an internal security team.

A scanner lists possible flaws; pentesting with Strike exploits them in a controlled way to prove which are real and prioritize remediation with human judgment.

AI automates discovery and exploitation at scale with the multilayer engine, while the offensive team validates findings and defines guided remediation.

Yes. Every finding includes guided remediation with concrete steps, and the SGS 24/7 SOC supports the fix and verifies closure.

It's a good starting point, but your attack surface changes with every deployment. For permanent coverage, see SGS continuous pentesting.

A one-time pentest is a snapshot of a moment; the continuous model is permanent offensive monitoring that re-tests your attack surface after every change.

Monitoring is permanent and, on top of that, each change or new deployment triggers a re-test of the affected surface, without waiting for a scheduled date.

It doesn't replace them: it complements them. Continuous pentesting probes offensively and permanently, and its findings integrate with the SGS 24/7 SOC for response.

A scanner lists possible flaws; Strike exploits them in a controlled way to prove which are real and prioritize remediation with human judgment.

Yes. SGS is the official Strike distributor for Latin America: local contracting, Spanish support and integration with its 24/7 SOC.

Yes. You can start with a one-time pentest and then move to continuous pentesting to cover every change in your attack surface.

It is a technology that runs every unknown file inside a kernel container: it works normally for the user, but with no real access to disk, registry or system memory.

Yes. The Xcitium agent unites antivirus, EDR/XDR and containment in a single component, so it replaces traditional protection instead of stacking on it.

Yes. SGS is the official Xcitium distributor for Latin America and runs it as a managed service from its 24/7 SOC on its own datacenter in Costa Rica.

No. The container is lightweight and transparent: only the unknown is virtualized; already-trusted apps run normally.

EDR focuses on the endpoint: which processes, files and connections happen on each device. XDR extends that visibility and correlates signals beyond the endpoint to see the full attack chain.

The Xcitium agent brings antivirus, EDR and containment into a single component, so it replaces traditional protection rather than stacking on top of it.

The SGS 24/7 SOC. Our analysts investigate, correlate and execute the response — isolation and remediation — without depending on your team being available.

They share the same Xcitium agent: ZeroDwell contains the unknown at execution time, and EDR/XDR records and correlates all behavior for investigation and response.

It replaces and integrates it: antivirus, EDR and containment in a single agent. Containment covers exactly what traditional antivirus misses — the unknown.

The container is lightweight and transparent: the user perceives no blocks. Only the unknown is virtualized.

It runs normally inside the container while the verdict resolves; once confirmed safe, it is released with no user intervention.

Yes. SGS deploys, monitors and responds from its 24/7 SOC on its own datacenter in Costa Rica, as part of Security 360°.

That's exactly where containment shines: being unknown, it runs automatically inside the container. Whatever it tries to encrypt, it never touches your real files.

Backups remain good practice, but containment aims for you to never need them: if encryption never happens on real data, there is nothing to restore.

No. Only the unknown is contained; already-trusted applications run normally. The user works with no blocks or confirmation prompts.

Yes. Every contained event is investigated and remediated by our 24/7 SOC from our own datacenter in Costa Rica, as part of Security 360°.

No filter catches 100%. When a malicious email gets through, the only defense left is the person. Whalemate reduces how many take the bait and how fast they report.

No: it complements it. WebMon stops technical phishing (authentication, gateway); Whalemate covers the human factor. Together they close email from both sides.

Yes. SGS is the official Whalemate distributor for Latin America, with local rollout and Spanish-language campaigns.

No. They are controlled, safe campaigns: no one receives real malware. Only behavior is measured and whoever needs it gets training.

Yes. SGS operates its own data center in Costa Rica, which is the base of the 24/7 NOC and SOC. We do not depend on third-party infrastructure abroad.

Yes. You can host your own equipment via colocation or provision virtual servers on our platform, both managed from Costa Rica.

Yes. The infrastructure is in-country, enabling local data sovereignty for compliance, control and lower latency within Costa Rica.

Yes. The NOC and 24/7 SOC monitor power, redundancy and services from the same data center, with backups and managed response.

The NOC watches the availability and performance of your infrastructure; the SOC watches security against threats. SGS runs both 24/7 on its own datacenter in Costa Rica.

Servers, networks and services: their health, availability and performance, continuously, with proactive alerts on any degradation.

On SGS's own datacenter in Costa Rica, with coverage for clients across Latin America.

No. SGS runs the NOC as a managed service, so you get 24/7 monitoring and alerts with or without an in-house IT team.

On the SGS-owned data center in Costa Rica, on NVMe storage. Your data stays in-country, with close local support.

Yes. You manage your hosting from cPanel and each site includes an SSL certificate, plus DNS managed on Cloudflare.

Yes. We set up DKIM/DMARC authentication for your domain, which improves deliverability and reduces spoofing of your email.

Yes. Hosting includes backups on our own infrastructure in Costa Rica, to restore your site and email when needed.

On the SGS-owned data center in Costa Rica. Your backups and data stay in-country, monitored by the 24/7 NOC and SOC.

Backup keeps copies of your data; disaster recovery (DR) adds replication and plans to restore the full operation after a major incident.

Yes. With managed backups and replication you can restore your data after a ransomware attack, reducing downtime and information loss.

Yes. SGS manages backups, replication and recovery from its 24/7 SOC on its own data center in Costa Rica, for your business continuity.

It is not required: we administer your SQL Server wherever it runs today. If you prefer, we can host it on our own datacenter in Costa Rica.

We schedule periodic backups and run restore tests to confirm they are recoverable, not just that they were generated.

Yes. We act as your dedicated DBA or as specialist backup for your team, depending on the model you need.

Yes. Monitoring and incident response run 24/7 from the SGS NOC/SOC on its own datacenter in Costa Rica.

Yes. We administer your Oracle database remotely in its current location, and if you prefer we can host it on our own datacenter in Costa Rica.

We use RMAN with scheduled backups and run recovery tests to confirm the database can be restored when needed.

Yes. We implement high-availability schemes with Data Guard and replicas to keep service continuity in case of failures.

Yes. Remote support and incident response run 24/7 for clients across Latin America from the SGS NOC/SOC on its own datacenter in Costa Rica.