When it has already happened
Containment first, then eradication, then the analysis that tells you how far it went. Retainer clients are engaged within thirty minutes, at any hour.
What the first month looks like
Timings are typical for a mid-sized estate. The sequence does not change; the clock does.
- Hour 0
Engage
One number, answered by an analyst who can make decisions. We establish what you know, what you suspect, and what must keep running.
- Hour 0 – 4
Contain
Stop the spread before collecting anything. Isolation is planned with your operations team so containment does not cost you more than the intrusion.
- Hour 4 – 48
Investigate
Scope the intrusion: initial access, dwell time, lateral movement, what was reached and what was taken. Evidence is collected to a standard that survives scrutiny.
- Day 2 – 10
Eradicate
Remove persistence, rotate what must be rotated, and rebuild what cannot be trusted. We do not declare an environment clean because the alerts stopped.
- Day 10 – 30
Recover & report
Staged return to service with heightened monitoring, then a post-mortem written for two audiences: your engineers and your board.
Cheaper than the first day without one
Emergency engagements are possible, but the hours you lose establishing authority and access are hours the intrusion keeps running.
Evidence that survives the room it ends up in
Insurers dispute claims. Regulators ask for the working. A report that cannot show how a conclusion was reached is worth very little six months later, so we write for that day rather than this one.
Regulatory obligations after an incident- Forensic images and volatile memory captured before remediation
- Hashes and timestamps recorded at collection
- A documented custody log for every artefact
- Findings separated from interpretation in the written report
- A statement of what could not be determined, and why