Incident Response
When an attack hits, we help you contain it, find out what happened and get back to business safely.
Overview
Contain it.
Understand it.
Recover.
In a cyber incident, every hour an attacker keeps their access gives them more time to do damage.
We help you contain the attack, remove the attacker's access, find out what happened and restore your systems safely.
The best time to plan for an incident is before one happens, so we help you prepare too.
Approach
First principles.
- 01
Contain first
Stopping the attack from spreading comes first, without destroying the evidence needed to understand it.
- 02
Follow the evidence
Logs and systems show how the attacker got in and what they touched. We trace the chain back to its start, so the way in gets closed.
- 03
Recover with confidence
Systems go back into service once the attacker's access is gone and the way in is closed.
Scope
What's included
Emergency response
Triage, containing the attack and removing the attacker's access.
Investigation
Finding out how they got in, what they accessed and which data was affected.
Recovery
Restoring systems safely and closing the way in.
Reporting
A timeline and root cause, with a plain-English summary for leadership.
Readiness
Incident response plans and exercises that rehearse an attack before one happens.
Engage