Incident response

What it is

Incident response is organized around a few questions. Is the attacker still in? What did they touch? How do we get them out and keep them out? What do we have to tell customers, insurers or regulators?

Our approach follows NIST SP 800-61 Revision 3, published in April 2025, which ties incident response to the six functions of the NIST Cybersecurity Framework 2.0.

What you get

• Help with containment decisions in the first hours
• Investigation of how the attacker got in and what they reached
• Removal of attacker access and verification that it is gone
• Recovery support and a plan for bringing systems back safely
• A written timeline and findings you can share with insurers, counsel and customers
• Fixes to the gaps that let it happen

The first hour

What you do before we arrive matters. These five steps protect the evidence and slow the attacker down.

1. Disconnect, do not power off

   Pull affected machines off the network. Leave them running if you can, because memory holds evidence that disappears at shutdown.

2. Do not wipe or reinstall yet

   Cleaning a machine before it is examined destroys the evidence of how the attacker got in.

3. Change credentials from a clean device

   Reset passwords and revoke sessions for affected accounts using a machine you trust, not the compromised one.

4. Write down what you see

   Times, ransom notes, odd logins, names of affected systems. Screenshots help.

5. Call us

   Phone or email below. Tell us what you are seeing and we will take it from there.

How it works

1. Contact and triage

   You call or write. We ask what you are seeing and decide what to do in the next hour.

2. Contain

   We help isolate affected systems and accounts without destroying evidence.

3. Investigate

   We collect logs and system data, build a timeline and find the entry point.

4. Eradicate and recover

   We remove the attacker’s access, reset credentials from a clean machine and restore systems.

5. Report and harden

   You get a written account and a short list of changes that would have stopped it.

What we need from you

• Someone with authority to approve actions on your systems
• Access to affected systems, logs and any security tools you run
• A list of what you have already done, so we do not repeat or undo it