Incident response
Named responders on retainer who contain the incident, preserve evidence, and get you back online.
What the engagement covers.
Retainer
Guaranteed response times, a named lead who already knows your environment, and pre-agreed terms so nobody negotiates during a breach.
Containment
Isolating affected systems, revoking credentials, and blocking attacker infrastructure without destroying evidence.
Forensics
Disk, memory, cloud, and log analysis to establish how the attacker got in, what they touched, and whether they are still there.
Recovery
Rebuilding systems in a known-good state and verifying the attacker's access is gone before you go back online.
Readiness
Tabletop exercises and playbook reviews so the first time your team runs the plan is not during a real incident.
How it runs.
Prepare
Onboarding call, environment overview, contact tree, and playbook review. Retainer hours can be used for readiness work.
Respond
One call activates the team. A lead responder is engaged within the retainer's response time, remote first and on site if needed.
Investigate
Evidence is preserved and analyzed while containment proceeds. You get a daily briefing in plain language.
Close
Recovery verified, a full timeline delivered, regulatory notification supported, and a lessons-learned session held.
What you receive.
- Incident timeline and root cause report
- Evidence preserved in a form your lawyers and insurers accept
- Regulatory and customer notification support
- Lessons-learned session and prioritized hardening plan
Who it is for.
- Companies with cyber insurance that requires a named response provider
- Organizations without an in-house incident response capability
- Teams that want a partner who has seen their environment before the bad day
Questions about incident response.
Can you help if we are not on retainer?
Yes. Emergency engagements are available, subject to responder availability. Retainer clients are prioritized and skip contracting during the incident.
Do you work with our insurer and lawyers?
Yes. We are used to working under legal privilege and with insurer-appointed counsel, and we preserve evidence to the standard they expect.
What are the response times?
Retainer tiers offer a first response within one, four, or eight hours. Most clients choose four hours with an option for on-site attendance.
Scope a incident response engagement.
Tell us about the system and the deadline. You will get a fixed-price proposal after one scoping call.