Incident response
We scope the incident, help you contain it, and stay with you through cleanup and recovery, remotely or alongside your team.
Digital forensics and incident response
For when something has already happened.
Our incident response team helps you work out how an attacker got in, what they touched and what you need to do next. We've worked incidents in enterprise, cloud and industrial environments, and we write up what we find in language your leadership can act on.
- Day 1, 09:12. Phishing email opened. Source: mail logs
- Day 1, 09:20. Password used from a new device. Source: identity provider
- Day 2, 02:05. New access key created. Source: cloud audit log
- Day 2, 06:40. Key disabled, sessions revoked. Source: response record
What we do
From the first call to the final report.
Forensic analysis
Endpoints, user accounts, mailboxes and cloud audit logs. We rebuild the timeline from the evidence and note where every fact came from.
Compromise assessment
Something feels wrong but nothing has fired. We look for signs of an intruder already inside and tell you plainly what we did and didn't find.
Incident retainer
Contracts, contacts and access agreed ahead of time, so on a bad day we start working instead of negotiating terms.
Plans and exercises
Response plans that match how your company actually works, and tabletop exercises that test them before a real incident does.
Lessons that stick
New detections for what we saw, fixes ranked by how much risk they remove, and a check-in later to see what got done.
How an engagement runs
What to expect once we're on the case.
Incidents are stressful and messy. We try to make our part predictable, so you always know what we're doing, what we've found so far and what we need from you.
First call
We hear what you know, agree who's involved and decide what needs protecting first.
Scope
We work out which systems and accounts are in play and get the access we need, read-only where we can.
Investigate
Evidence goes into Steward, which keeps the timeline and ties every finding to its source.
Contain
We recommend containment steps and carry them out with your approval, or guide your team through them.
Report
A written account of what happened, how we know, and what to change so it doesn't happen again.
What you get at the end
A report you can stand behind.
After an incident, people ask hard questions: the board, your customers, your insurer, sometimes a regulator. Our reports are written so you can answer them.
- A timelineWhat happened and when, with each entry tied to the log, file or system it came from.
- The findingsHow the attacker got in, what they reached, and what we're confident about versus what we can't rule out.
- What to fixA short, ranked list of changes, starting with the ones that would have stopped this incident.
- The evidence trailThe record of what we checked stays with the case, so your team or an outside reviewer can follow our reasoning.
Active incident
Need help with an incident right now?
Email us with INCIDENT in the subject line. We pick those messages up first. Put these in the message so we can call you back ready to work:
- What you're seeing, and roughly when it started
- Which systems, accounts or offices seem to be involved
- A phone number we can call, and who else is already working on it
- If you think your email may be compromised, write from an account the attacker can't read
Who does the work
Responders who've been in the room before.
Our team has handled incidents and run detection programs across enterprise, cloud and industrial environments, including OT and ICS. We also come from offensive security and purple-team work, which helps when you're trying to think like the person who got in.