INCIDENT RESPONSE
Ransomware and data breach containment by a CREST/OSCP-certified team, following NIST SP 800-61.
We help you make the hard calls in the right order: stop the spread first, keep the traces that explain what happened, then remove the attacker.
We follow NIST SP 800-61 and the SANS Incident Response Framework, so every engagement goes through the same steps.
Services
Emergency breach response
Remote or on-site response to an active incident. A lead responder directs containment from the first call.
Investigation & root cause
We rebuild the timeline from logs and affected systems, analyse malware and persistence, and find the root cause.
Ransomware response
Stop the encryption from spreading, assess what was affected, and harden systems against a repeat attack.
Readiness & tabletop exercises
Build your response plan and rehearse scenarios with your team.
How we respond
We work through the six steps of the SANS Incident Response Framework. They map to the life cycle in NIST SP 800-61: Detect, Respond, and Recover during the incident, Govern, Identify, and Protect as preparation, and Improvement for lessons learned.
Preparation
Set the response plan, roles, and escalation paths before an incident. Our readiness and tabletop exercises help with this.
NIST: Govern, Identify, Protect
Identification
Confirm whether an alert is a real incident, then set its type and severity. Documentation starts here.
NIST: Detect
Containment
Isolate affected systems to stop the spread, without wiping the traces that show how the attacker got in.
NIST: Respond
Eradication
Remove malware, persistence, and compromised accounts, so the attacker does not come back with the restored systems.
NIST: Respond
Recovery
Your team brings systems back online. We advise on the order and checks, and watch for signs of the attacker returning.
NIST: Recover
Lessons Learned
A written review of what happened, the root cause, and what to fix. The findings go back into preparation.
NIST: Improvement
Why the first hours matter
Moving too slowly
The attacker can spread, take data, or launch ransomware across more systems.
Moving too fast
- Shutting down the wrong machine can hide where the attacker is moving
- Rebooting a server can wipe the evidence in memory
- Paying a ransom before you know the scope still leaves you unsure whether they are gone
That loses the memory data, live connections, and logs that show how they got in and whether they are still there. A machine that has only been switched off can still carry the attacker's persistence.
In the first hours we contain the spread while keeping enough of that record to decide what to rebuild, what to reset, and whether data left your network.
What you get
Our team works with your IT staff from the moment we are called in until the incident is under control. At the end you receive a written report covering what happened and how far it spread.
Plain-language updates
We keep management updated in plain language throughout, so they can decide on systems, customers, and communications based on facts.
Forensic timeline
How the attacker got in and what they accessed.
Root cause
What allowed the intrusion, so it can be fixed.
Indicators of compromise
IOCs your monitoring can use to spot the same activity.
Hardening recommendations
What to change so the same attack does not work again.
Fix verification
After your team applies the fixes, we check them.
Who runs it
Our in-house team holds incident-response certifications including GCIH, GCIA, GCFA, and eCDFP. The same people run our penetration tests, so they know how attackers move and where they hide.
GCIHGIAC Certified Incident Handler
GCIAGIAC Certified Intrusion Analyst
GCFAGIAC Certified Forensic Analyst
eCDFPeLearnSecurity Certified Digital Forensics Professional
See all certifications held by the team.
We follow NIST SP 800-61 Revision 3 (Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, April 2025), which replaces Revision 2, and the six-step SANS Incident Response Framework. We collect only the evidence needed to contain the incident, find the root cause, and prevent a repeat. If you have specific reporting requirements, tell us at the start.
Penetration test and red teaming
Incident response covers what happens after an attacker gets in.
Last reviewed: 12 Oct 2026
INCIDENT RESPONSE
Our team works with your IT staff from the moment we are called in until the incident is under control.
Frequently asked questions
How is incident response different from a penetration test?
A penetration test looks for weaknesses before an attacker finds them. Incident response starts after an attacker is already in: stop the damage, remove them, and close the way they came in. Many organisations use both.
How fast should an organisation respond to an incident, and is there a standard?
There is no single response time that fits every incident. NIST SP 800-61 does not set time limits; it asks organisations to rank incidents by severity and handle the most serious first. An attack that is still spreading, such as ransomware, needs action immediately. A malware alert that is already contained can wait for working hours. Notification deadlines set by regulators or insurers are often the real constraint, so plan your internal targets around them. When you contact us, we agree the response timing based on how severe the incident is.
What types of incidents do you handle?
Ransomware, data breaches, insider threats, malware outbreaks, and system intrusions. For ransomware, we stop the spread, check what was affected, and harden the environment so the same attack does not work again.
What do we receive at the end of an engagement?
A written report: an executive summary, a timeline of the incident, the root cause, indicators of compromise (IOCs), and hardening recommendations. After your team applies the fixes, we check them.
Can you help us meet breach reporting timelines?
Yes. We help you establish quickly what happened, which data was affected, and the likely impact, and we prepare the documents you need for regulators, insurers, and affected parties. We work with your legal counsel on this.
Tell us what happened
When you contact us, we agree the response timing based on how severe the incident is.
