Cybersecurity
The first 24 hours of a cyber incident: what to do, and what not to
Decisions made in the first hours of an incident decide how much is lost, how long recovery takes and whether you can later explain what happened.
Digital Forensics & Incident Response (DFIR)
Fast containment when something goes wrong, followed by a forensically sound investigation of what happened and how.
Overview
The first hours of an incident decide most of its cost. Systems get wiped and rebuilt before anyone takes an image, logs roll over, and the evidence needed to understand the attack, or to support a police report or insurance claim, is lost. Our responders join remotely within the agreed time, stabilise the situation and preserve evidence before recovery starts.
Investigations cover disks, memory, mobile devices, email and cloud logs, with chain of custody maintained throughout. We handle ransomware, business email compromise and payment fraud, insider cases and compromise assessments for companies that suspect, but cannot prove, that someone is inside. A retainer guarantees response times and includes a yearly readiness exercise.
What the service covers
| Service | Scope | Methods and outputs |
|---|---|---|
| Incident response | Rapid triage, containment, eradication and recovery, led on site or remotely by experienced responders. | Triage, Containment, Recovery |
| Digital forensics | Forensically sound acquisition and analysis of disks, memory, mobile devices, cloud and email, with chain of custody. | Disk and memory, Mobile, Chain of custody |
| Ransomware response | Scoping, containment, decryption options, recovery planning and support with stakeholders and regulators. | Ransomware, Recovery, Stakeholder support |
| Compromise assessment | A proactive sweep to find out whether an attacker is already inside, before or after a merger or incident. | Compromise assessment, Hunting, M&A due diligence |
| Fraud and BEC investigation | Business email compromise, payment fraud and insider investigations, with evidence prepared for legal action. | BEC, Payment fraud, Insider threat |
| IR retainer | Pre-agreed response hours, guaranteed response times and annual readiness exercises. | Retainer, Response SLA, Readiness |
How an engagement runs
Scope and rules of engagement
We agree objectives, scope, timing and authority in writing before any testing or monitoring starts.
Assess
We establish what you have, how it is exposed and what an attacker would target first.
Prioritise
Findings ranked by business impact, with a remediation plan your team can act on.
Protect and verify
Controls implemented, then retested to confirm the fix works.
Monitor and respond
24/7 detection, with a tested plan and our responders on call when an incident occurs.
From our insights
-
-
Cybersecurity
External and internal penetration testing: what each one tells you
An external test shows what the internet can reach. An internal test shows what happens after the first laptop is compromised, which is where most serious incidents are decided.
-
Cybersecurity
Eight questions to ask before you choose a managed detection and response provider
Every MDR proposal promises 24/7 monitoring. The differences that matter are in what is monitored, who is watching and what they are allowed to do at 3 a.m.
Talk to us about Digital Forensics & Incident Response (DFIR)
Send us the details and the practice lead will reply within one business day.