Who This Is For
Organisations dealing with a live incident, a suspected breach, data theft by a departing employee, or a regulator, insurer or court asking what occurred.
What You Get
- Forensic acquisition of disks, memory and logs under chain of custody
- Timeline reconstruction: initial access, movement, persistence, exfiltration
- Malware and artefact analysis, with indicators of compromise
- Scope determination — which systems and whose data were affected
- Containment and eradication plan, and support while it is carried out
- Written report suitable for regulators, insurers and legal proceedings
- Post-incident review and the control changes that prevent a repeat
How the Engagement Runs
- TriageEstablish what is known, stop the bleeding, preserve evidence.
- AcquisitionCapture images and logs before they age out or are overwritten.
- AnalysisReconstruct the timeline and determine scope.
- ContainmentRemove access and close the route that was used.
- ReportingFindings written for the audience that has to act on them.
- HardeningFix what allowed it, and verify the fix.