We take charge of the response alongside your leadership team. Stop the spread, protect the evidence, find out what happened and get the business running again. You make the business calls. We run the technical response.
For
Leadership and security teams facing a live or suspected attack.
You get
A response lead, a decision log, an incident timeline and a plain-language brief for executives.
How to start
Send an incident request or write to us. We confirm scope and who leads in the first conversation.
Not included
Restoring systems from backups. See Ransomware Recovery and Recovery & Restoration.
Each window has a job, a decision that falls to you, and a trap we see often.
First hours
We
Name an incident lead. Set up a safe channel. Start the decision log. Preserve evidence before anything changes.
You
Declare the incident and set severity. Bring in counsel and your insurer.
Common trap
Waiting for certainty before acting.
Middle of day one
We
Weigh containment options against business impact and evidence. Build a written scope hypothesis with a confidence level.
You
Contain, preserve, or keep services running. Approve any workaround.
Common trap
Isolating everything by reflex, or nothing out of caution.
End of day one
We
Draft statements from verified facts. Start the notification clock register. Plan responder rotation, because tired teams make mistakes.
You
Approve staff, customer and regulator statements. Set recovery priorities.
Common trap
Speaking before the facts are firm.
Days two to seven
We
Confirm every way the attacker stays in. Remove access in one coordinated move. Rebuild from known-good sources.
You
Approve downtime for eviction. Sign off on restored services.
Common trap
Evicting too early, then watching them return.
After
We
Write the technical report and the executive brief. Agree fixes with owners. Feed lessons into your plan.
You
Fund the fixes. Decide what to tell customers and partners.
Common trap
Closing the incident when the pressure ends.
These steps keep your options open.
14 days
median time an attacker was inside before detection in 2025, up from 11 days.
Google Cloud, M-Trends 2026
52%
of organizations first noticed the attack themselves in 2025, up from 43%.
M-Trends 2026
$4.99M
global average cost of a data breach, a record, up 12%.
IBM Cost of a Data Breach 2026
Sample: decision log (illustrative)
Isolate file servers FS-02 to FS-04
Owner: incident lead, COO. Basis: spread seen on 3 hosts; backups not yet confirmed clean.
Engage outside counsel and notify insurer
Owner: general counsel. Basis: policy requires notice within 24 hours.
Hold public statement until scope is firm
Owner: CEO, comms. Basis: scope confidence is low.
Start register of notification deadlines
Owner: general counsel. Basis: personal data may be involved.
72 hours
EU GDPR, Article 33: notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. ADGM Article 32 sets the same outer limit.
4 business days
US SEC Form 8-K Item 1.05: disclose a material incident within four business days of deciding it is material.
On awareness
UAE PDPL, Article 9: the controller acts when it becomes aware of a breach.
Your counsel confirms which apply to you.
| Item | During an incident | Terms agreed in advance |
|---|---|---|
| Paperwork | Agreed during the incident, while the clock runs. | Signed in advance: contacts, access, escalation, reporting lines. |
| First conversation | We learn your environment from scratch. | We have a map of your systems and your people. |
| Best for | Teams with a strong internal response who want a second pair of hands. | Teams where one bad night would stop the business. |
Incident response as part of cyber risk management, aligned to CSF 2.0.
Federal playbooks for incident and vulnerability response, including evidence handling and eviction steps.
International guidance on managing information security incidents.
We guide the rebuild. Ransomware Recovery and Recovery & Restoration run the restore.
We work with your counsel and do not replace them. Notification and ransom decisions stay with you and your lawyers.
We give you facts and options. Contact with an attacker involves counsel first.
No. You can contact us during an incident. A retainer agrees terms, contacts and access in advance, so the first hours go to the response and not the contract.
Yes. Counsel should be involved early, and many policies set notice conditions. We work to their instructions on privilege and reporting.
That is a business and legal decision. We give you what we know about the attacker, the data and your recovery options. Your counsel advises on law and sanctions.
Often, in part. We weigh each containment step against business impact and evidence, and agree workarounds with the business owner.
It depends on how far the attacker got. The first day is about control. Eviction and rebuild usually take days, and hardening takes longer. We give you a view once we have scoped it.
Tell us what you see. We confirm scope and who leads in the first conversation.
