Incident diagnosis and response
We understand what happened before remediation, preserve the evidence and support your containment.
Incident diagnosis
Before you remediate, understand what happened
Remediating without understanding the incident can destroy evidence and send the effort after the wrong hypothesis. Diagnosis reduces uncertainty and sets a proportionate path.
- 01Kick-off meetingWhat was detected, when, by whom, and which decisions were made.
- 02Preliminary timelineInterviews, alerts, logs and emails organized into a timeline.
- 03Asset inventoryRole, criticality, exposure and status of each affected system.
- 04Source preservationLogs, snapshots, backups and emails before they are overwritten.
- 05Technical and impact reviewIndicators of compromise, persistence, lateral movement and severity.
- 06Recommended pathForensics, consulting, or process and technology assurance.
Ransomware
Beyond the encrypted files: entry vector, accounts used, lateral movement and possible prior exfiltration for double extortion.
Typical path · forensics + hardeningData leak
Whether data was accessed, copied or published, and whether the source is internal, a vendor or a misconfigured repository.
Typical path · forensics or cloud reviewImpersonation
Look-alike domains, compromised accounts or bank-account change fraud. Review of SPF, DKIM, DMARC and forwarding rules.
Typical path · forensics or brand protectionContact
Let’s talk about your case
We respond confidentially. If this is an ongoing incident, say so in the form and we will prioritize your case.