Services · Defend
Incident response
When something has already gone wrong, we help you work out what happened, stop it spreading, remove the attacker’s access and recover. We work on the access you grant and keep a written record throughout.
What it covers
- Scoping the affected systems, accounts and data
- Collecting and preserving evidence from endpoints, logs and cloud accounts
- Building a timeline of the attacker’s activity from that evidence
- Containment and eradication through actions you approve
- Recovery support and hardening to make a repeat harder
- Working alongside your internal teams and advisers, where you ask us to
How an engagement runs
First call
We take the facts you have, agree immediate priorities, and confirm who on your side can approve actions on your systems.
Agree access and authority
We confirm in writing which systems we may access, what we may change, and who approves containment.
Investigate and contain
We collect evidence, establish what the attacker did, and contain it through the actions you approve.
Eradicate and recover
We help remove the attacker’s access, restore affected systems and close the gaps they used.
Report and debrief
We write up what happened and walk your team through it, including what to change next.
What you receive
- A written incident report with the timeline, affected assets and actions taken
- The root cause, where the evidence supports one
- Evidence handled and retained as agreed with you
- Prioritised recommendations to prevent a repeat
- A debrief call with your team
Talk to us about incident response.
Tell us about your environment and what you need covered, and we will talk you through how it would work for you.