Incident Response
Containment, eradication, and recovery when something has already happened. We arrive, establish the real scope, and remove the adversary — without destroying the evidence along the way.
- Who it is for
- Any organization that suspects an active intrusion, ransomware, internal fraud, or data exfiltration.
- Typical duration
- Immediate activation
- Frameworks
- NIST SP 800-61r3SANS PICERLISO/IEC 27035
If you suspect an incident in progress, write to [email protected] with INCIDENT in the subject line. We prioritize the response.
The first hours decide the outcome
In most incidents we handle, the avoidable damage was not caused by the attacker — it was caused by the improvised reaction of the first few hours. Servers powered off, wiping the volatile memory that held the evidence. Credentials half-rotated, alerting the adversary without removing them. Backups restored onto the same vulnerability that allowed entry, with reinfection within days.
Before you call: four things
If you are reading this during an incident:
- Do not power off compromised systems. Isolate them from the network — pull the cable or move the segment — but keep them running. RAM holds evidence that is lost on shutdown.
- Do not delete anything, and do not let the antivirus “clean” the malware yet. We need to see what it did and since when.
- Preserve logs now. Many systems rotate logs within days. Pull them and store them somewhere separate.
- Communicate out of band. If the adversary is inside, they are probably reading corporate email and internal chat. Coordinate the response over a different channel.
Working with third parties
We work alongside your cyber insurer, your legal counsel, and, where appropriate, the authorities. The report is structured from the outset to support a claim and to answer a regulatory request — not as a technical document that has to be hastily translated afterward.
How we run it
- 01
Activation and triage
We establish what we know, what we do not, and what must not be touched yet.
- 02
Containment
Stopping forward progress without needlessly alerting the adversary or destroying evidence. Powering off the compromised server is almost never the right first move.
- 03
Investigation and scoping
Forensic analysis across affected systems to answer the question your board will ask: how far did they get and what did they take?
- 04
Eradication
Removal of all persistence. A poorly eradicated incident reopens within weeks, usually with more damage.
- 05
Recovery and closure
Phased return to operation with heightened monitoring, and a report that serves both the technical team and the insurance claim process.
What you receive
- Initial containment and a stop to the adversary's forward progress
- Determination of real scope — what was compromised and what was not
- Verified eradication and a phased recovery plan
- Root cause report suitable for your insurer, your regulator, and your board
- Lessons learned converted into concrete controls and detections