Incident Response
When someone's already inside, speed and clarity matter.
We help you understand what happened, contain it, and get back to operating — while keeping leadership, legal counsel, and insurers informed with facts rather than guesses.
What we cover
Every engagement is scoped to your environment — these are the areas we typically work across.
Triage & scoping
Rapid assessment of what's affected, what's at risk, and what needs to happen in the first hours to limit the damage.
Containment & eradication
Cutting off attacker access, removing persistence, and resetting credentials — in the right order, so the attacker isn't tipped off too early.
Forensic investigation
Log, endpoint, and cloud audit analysis to reconstruct the timeline: how they got in, what they touched, and what left your environment.
Ransomware & business email compromise
Focused response for the incidents we see most often — scoping encryption and exfiltration, or tracing mailbox access and fraudulent payments.
Stakeholder communication
Clear, factual updates for leadership, legal counsel, and insurers, and the evidence needed to support regulatory notification decisions.
Recovery & hardening
Closing the entry point and hardening the environment so the same attack path can't be used again.
What you get
- Incident timeline from initial access to containment
- Root cause analysis — how the attacker got in and why it worked
- Scope of impact: affected systems and data, backed by evidence
- Evidence preserved and documented for legal and insurance purposes
- Executive and technical reports
- Hardening recommendations and lessons learned
- Methodology
- NIST SP 800-61
- Timeline
- Scoped around severity. Work starts with triage — deeper investigation is scoped once we understand what we're dealing with.
- Confidentiality
- NDA signed before scoping. Evidence encrypted and deleted on an agreed schedule.
Incident Response FAQ
What should we do before we call you?
Don't wipe or rebuild affected systems — that destroys evidence. Isolate them from the network rather than powering them off where possible, preserve logs, and write down what you've observed and when.
Should we pay the ransom?
That's a business and legal decision, and it's yours. We give you the facts it depends on — scope of encryption, whether backups are viable, and whether data was exfiltrated — to inform it together with counsel and your insurer.
Do you work with our cyber insurer and lawyers?
Yes. We communicate with insurers and legal counsel where needed and structure our findings so they can be used for claims and notification decisions.
Can we agree terms before an incident happens?
Yes, and we recommend it. Having an NDA and engagement terms in place beforehand means no paperwork slows us down when it matters.
Talk to us about Incident Response.
Tell us what you're trying to protect. We'll tell you honestly whether we're the right fit.
Active incident? Report it now — we'll get back to you as soon as possible.