Respond
It has happened. What now?
The first hours shape the whole incident. Contain the attack, find out what happened and run the response, from the server room to the boardroom.
The first hours
Pick the moment you are in
Incident Response We think we are under attack. Who leads?Incident ResponseLead the response to a live or suspected attack.Learn more →Ransomware Response Our files are encrypted. What now?Ransomware ResponseContain encryption and extortion, assess the damage, and set options with your counsel.More about this service →DFIR What exactly happened?Digital Forensics & Incident Response (DFIR)Collect and analyze evidence to show how it happened, in a form that holds up.More about this service →Threat Investigation Is this activity an incident?Threat InvestigationLook into suspicious activity and say whether it is an incident.More about this service →Identity Threat Response How do we shut out a stolen account?Identity Threat ResponseContain the misuse of stolen or abused accounts.More about this service →Breach Response What was exposed, and who must we tell?Breach ResponseWork out what data was exposed, to whom, and what you must tell regulators and people.More about this service →Crisis Management Who decides, and what do we say?Crisis ManagementRun the leadership side: decisions, statements and deadlines.More about this service →
If this sounds like you
- There is no named person who leads when an incident starts.
- Nobody knows who you must tell, or by when.
- Your evidence would not survive a legal challenge.