Home / Consulting / Incident response
Incident response
When it has already happened, the clock is the only thing that matters.
Our responders are the analysts who staff the SOC. They have seen the alerts that come before a breach, which is why they know where to look first.
What happens when you call
The first hours, in order
STEP 1
A responder answers
A person, not a ticket form. They open a bridge and stay on it.
STEP 2
Scope before action
What is touched, what is spreading, and what must not be turned off.
STEP 3
Contain, keep the evidence
We isolate without destroying what an investigation or an insurer will need.
STEP 4
Written situation report
One page your executives can act on, updated as the picture changes.
Retainer
Have the team on the books before you need them
A retainer means the contract, the contacts and the access questions are settled on a quiet day, so a bad day starts with response rather than paperwork. It covers emergency response and can include readiness work — playbooks, tabletop exercises and a compromise assessment.
- A named team and a number that is answered
- Terms agreed in advance, no procurement during an incident
- Tabletop exercises and playbooks for your estate
- Escalation straight from our managed SIEM, if you use it
While you wait for us
- Do not switch machines off. Disconnect them from the network instead.
- Do not pay or reply to a ransom demand before you have spoken to us.
- Use a clean channel. Assume the attacker can read company email.
- Write down the time you first noticed, and what you saw.
