Incident Response Services

• Live containment
• Forensics
• Regulator reporting
• Root-cause closure

Incident response is judged on two things: how fast the bleeding stops, and whether you can prove afterwards what happened. Most engagements deliver the first and improvise the second.

Engagement modes

• Retainer. Pre-agreed terms, pre-shared architecture, named contacts. When something happens we are already authorized and already understand your estate.
• Emergency. No prior relationship. The first hours go to scoping and access, which is precisely why a retainer is cheaper than it looks.
• Post-incident engineering. After the responder leaves, the path that was used is usually still open. We close it.

How we run an incident

1. Scope and preserveEstablish what is affected and capture volatile evidence before containment destroys it. Containment first is a common and expensive instinct.
2. ContainIsolate at the network layer, revoke credentials and sessions, and cut persistence. Segmentation built beforehand is what makes this fast.
3. EradicateRemove the access path, not only the payload. Reimaging a host that was reached through a stolen token buys you days.
4. RecoverRestore in a sequence that does not reintroduce the compromise, with monitoring raised on the restored estate.
5. ReportA timeline with evidence references, written to survive regulator, insurer and counsel review.
6. Close the gapThe engineering change that makes this specific incident non-repeatable, scoped and costed.

The first hour

Order of volatility

Evidence is captured most-volatile-first, because containment and reboots destroy the top of this list.

Memory is where injected code, decryption keys and live C2 state live. A well-intentioned first responder who pulls the power destroys the most valuable evidence in the incident.

Worked example — business email compromise into wire fraud

Call received: Thursday 16:40. Finance had wired $340,000 against instructions that appeared to come from the CFO's genuine mailbox.

1. 16:40–17:10 — ScopeCloud audit logs pulled first, because their retention window was the binding constraint. Sign-ins from an unfamiliar ASN over eleven days. One mailbox confirmed compromised, four more with suspicious sign-ins.
2. 17:10 — Money firstThe bank was contacted in parallel with technical work. Recall succeeded on $210,000. Technically uninteresting; commercially the most valuable action of the night, and it is the step purely technical responders forget.
3. 17:30 — PreserveMailbox audit logs, message trace and rule configuration exported before any change. An inbox rule was silently moving replies containing "wire" or "invoice" to RSS Subscriptions — a folder nobody opens.
4. 18:00 — ContainSessions revoked across all five accounts, not just passwords reset. A password reset without session revocation leaves the attacker's token valid, and this is the single most common containment error in cloud identity incidents.
5. Day 2 — EradicateThe access path was a legacy authentication endpoint bypassing MFA. Disabled tenant-wide. Two integrations broke and were fixed within the week — an acceptable trade, decided explicitly with the business rather than unilaterally.
6. Day 3 — RecoverConditional access rebuilt, phishing-resistant MFA for finance and executives, and an out-of-band verbal verification step for payment changes over a threshold.
7. Week 2 — ReportTimeline with evidence references, delivered to counsel and the insurer. The insurer accepted it without a follow-up request, which is the actual bar.

Choosing between incident response service providers

Critical incident response services are bought under time pressure, which is exactly when due diligence is hardest. The questions that separate incident response service providers are these:

• Who actually shows up? Named responders, or whoever is on the bench that week.
• Do they do the engineering afterwards? Many firms contain and leave. The access path is usually still open.
• Will the report survive counsel and an insurer? Ask to see a redacted example before you need one.
• Can they work your cloud and OT estate? Many are endpoint-only, and the incident rarely is.
• What is pre-provisioned? Emergency engagements routinely lose their first six hours to access provisioning.

Retainer versus emergency

The access line is the real difference. Emergency engagements routinely lose their first six hours to provisioning credentials — while the intrusion continues.