When prevention fails, the clock is the only thing that matters.

Our team contains the incident, preserves the evidence, establishes what actually happened and closes the route in. Retainer clients get a responder who already knows their environment before the call is made.

Call received

A responder is on the line, not a ticket queue. We establish what you are seeing, what is still running and what must not be touched.

Triage and scoping

Initial scope agreed: which systems, which accounts, which data. Evidence preservation starts before anything is rebuilt.

Containment

Affected hosts isolated while remaining reachable to us, accounts disabled, attacker access cut. Business continuity decisions made with you, not for you.

Forensics

Memory, disk and log evidence collected and analysed. The who, the what and the how, established from artefacts rather than assumption.

Root cause and closure

The entry point identified and closed, a written timeline delivered, and the controls that would have caught it earlier specified.

How they got in

The initial vector identified from artefacts: the phishing message, the exploited service, the reused credential, the supplier connection.

How long they were there

First and last observed activity, so you know whether this was hours or months and what was accessible throughout.

What they touched

Systems accessed, accounts used, data staged or moved, and whether exfiltration actually occurred or was only attempted.

What they used

Malware, remote access tooling and living-off-the-land techniques identified and, where possible, attributed to a known group.

What they left behind

Scheduled tasks, services, accounts and implants located and removed, so the rebuild does not reinstate the attacker.

What you must report

A factual timeline and impact assessment in the form your regulator, insurer and legal counsel each need.