Service 6 of 6
When something goes wrong, get clear answers fast.
A cyber incident brings pressure, incomplete information and decisions that can't wait. Leadership wants to know what happened. So do lawyers, insurers and sometimes regulators.
Our responders help you contain the threat, work out what was affected, preserve evidence properly and get back to normal operations with a plan to keep it from happening again.
Incident Response & Digital Forensics
During an incident, you need facts quickly.
The first hours of an incident are full of questions nobody can answer yet:
- Is the attacker still in the network?
- Which systems, accounts and data are affected?
- How did they get in?
- What did they access or take?
- Which evidence needs to be preserved?
- What can we shut down safely, and what will that break?
- Who has to be notified, and by when?
We bring incident coordination, technical investigation, forensics and threat intelligence together so those questions get answered in the right order.
What this practice covers
6 areas of work. Choose one to see the detail.
Incident response
Contain the threat and regain control.
Incident types
- Ransomware and extortion
- Business email compromise and wire fraud
- Data breaches
- Cloud account compromise
- Identity compromise
- Insider threats
- Web application compromise
- Third-party and supply chain incidents
- Destructive attacks
Response support
- Emergency response and triage
- Scoping and containment planning
- Evidence preservation
- Eradication and recovery guidance
- Coordination with legal counsel and cyber insurers
- Executive and board briefings
- Post-incident review
Digital forensics
Establish what the evidence actually supports.
- Endpoint and server forensics
- Memory forensics
- Network forensics
- Cloud and SaaS forensics
- Email and Microsoft 365 investigations
- Mobile device forensics
- Log analysis and timeline reconstruction
- Root cause analysis
- Evidence handling with documented chain of custody
Our reports keep confirmed findings, reasonable inferences and open questions clearly apart. That matters when the report is read by lawyers, insurers or regulators.
Malware analysis
Understand what a malicious file does and how to find it elsewhere.
Analysis uses static, dynamic and reverse engineering techniques in an isolated lab.
We establish
- Behavior and capabilities
- Persistence mechanisms
- Command-and-control infrastructure
- Embedded configuration
- Indicators of compromise
- Links to known malware families and campaigns
Compromise assessment
Find out whether you have already been breached.
Useful before an acquisition, after a suspicious event or when a vendor you rely on has been compromised.
- Enterprise-wide threat hunting
- Indicator sweeps
- Persistence discovery
- Review of suspicious identity and cloud activity
- Historical log analysis
- Scoping of affected systems and accounts
Threat intelligence
Intelligence is only useful if it changes a decision.
- Threat actor and campaign profiling
- Analysis of tactics, techniques and procedures
- MITRE ATT&CK mapping
- Vulnerability intelligence
- Dark web monitoring for leaked credentials and data
- Intelligence reporting for security teams and executives
Incident response retainers
Agree on the details before you need them.
A retainer sets up the relationship in advance, so nobody is negotiating a contract in the middle of an incident. Retainers can also include readiness work, such as tabletop exercises, that keeps the time useful if no incident occurs.
- Agreed contact and escalation routes
- Defined response times
- Pre-approved access and evidence handling procedures
- Background on your environment and key contacts
- Tabletop exercises and readiness reviews
- Incident response plan development
Our approach
How we work
- 01
Stabilize
Set up communication, agree on immediate priorities and put a clear response structure in place.
- 02
Scope
Identify the affected systems, identities, data and business processes.
- 03
Investigate
Collect and analyze evidence to reconstruct what happened and measure the impact.
- 04
Contain
Cut off attacker access while weighing the effect on operations and on evidence.
- 05
Eradicate
Remove persistence, malicious tools, compromised access and the root cause.
- 06
Recover
Restore operations with validation and closer monitoring.
- 07
Improve
Turn what was learned into stronger architecture, identity controls, detections and response plans.
Deliverables
What you receive
- Incident timeline
- Scope of affected systems, accounts and data
- Forensic report with evidence and chain of custody records
- Record of containment and eradication actions
- Recovery and hardening recommendations
- Executive summary suitable for leadership, counsel and insurers
Supports these frameworks
Common in these industries
FAQ
Frequently asked questions
Should we call our cyber insurer or an incident response firm first?
Check your policy right away. Many policies require you to notify the carrier promptly and to use a response firm from its approved panel, and engaging a firm outside the panel without approval can affect coverage. It is also common to bring in outside legal counsel early so the investigation can be run under attorney-client privilege. If you are unsure, call us and we will help you work through the order.
What notification deadlines apply in Texas?
Texas law requires businesses to notify affected individuals within 60 days of determining that a breach of sensitive personal information occurred. If 250 or more Texas residents are affected, the Texas Attorney General must be notified within 30 days. Other deadlines may apply under HIPAA, SEC rules, DFARS, your contracts and the laws of other states, so involve legal counsel early.
What should we do before you arrive?
Do not wipe or rebuild affected systems yet, because that destroys evidence. Where possible, disconnect them from the network instead of powering them off. Preserve logs, move to out-of-band communication if email may be compromised, and write down what you have seen and when. Our emergency page has a short checklist.
If you suspect an incident, call now.
The earlier we start, the more evidence survives and the more options you have.