SOC & INCIDENT RESPONSE · PROFESSIONAL SERVICES
Contain it, then find out exactly what happened
An incident engagement that puts the order right: contain the attacker without destroying the evidence, establish root cause and scope, eradicate and recover to safe, normal running — and support the regulatory reporting that follows. It minimises downtime, financial loss and regulatory exposure while the incident is still live, across IT and OT alike.
ENGAGEMENT AT A GLANCE
EngagedOn a suspected or confirmed incident
ScopeIT and OT environments
OutputContainment plan + incident report
YOU RECEIVE
Triage assessment and an agreed containment plan
Evidence preserved before remediation touches anything
Root-cause and scope-of-breach analysis
Eradication and recovery to safe, normal operation
Regulatory reporting support and a lessons-learned review
WHAT'S COVERED
Scope of the engagement
01
Triage
What is happening, which systems are affected and what has to be contained first — established before anything is changed.
02
Containment
Cutting the attacker’s access without destroying the evidence, which is the part that goes wrong when containment is improvised.
03
Evidence preservation
Forensic images and volatile data captured under documented chain of custody, before remediation touches anything.
04
Root cause & scope
How they got in, how long they were there, what they reached and what was actually taken — from the evidence, not from assumption.
05
Eradication & recovery
Removing persistence and closing the entry route, with verification that the attacker is out before systems go back — and in an OT environment, safe before fast.
06
Regulatory reporting & lessons learned
The timeline and the scope-of-breach determination your regulator, insurer and counsel will each ask for, and a review so the next incident is shorter.
COMMON QUESTIONS
Before you ask
How quickly can you start?
Engagement begins as soon as scope and access are agreed. We do not publish a guaranteed response time, because a number nobody has contracted for is worth nothing at the moment you need it. If response time matters to you, agree it with us in advance and in writing.
Will containment destroy the evidence?
Not if the order is right. Preservation comes before remediation wherever it can, which is the main reason to involve the responders before rebuilding rather than afterwards.
What kinds of incident have you handled?
Hands-on ransomware response, web-shell and exploitation response, and firewall log forensics, including the regulatory reporting that follows an incident in a regulated sector. What that looks like for a specific incident is best discussed on the call.
THE DELIVERABLE
What lands on your desk at the end
Before you sign, ask us exactly what the report contains — it is the fastest way to judge whether the reporting would satisfy your regulator and your counsel.
REPORT CONTENTS
Executive summary of the incident, written for a board
Reconstructed attack timeline with supporting evidence
Root cause, scope-of-breach determination and affected data
Indicators of compromise, in a form your tooling can consume
Regulatory reporting record and lessons-learned actions
WHAT WE NEED FROM YOU
An incident owner authorised to approve containment actions
Access to affected systems, logs and security tooling
Your legal, regulatory and insurance notification obligations
An out-of-band communications channel, in case yours is compromised
FRAMEWORKS THIS EVIDENCES
NIST SP 800-61ISO/IEC 27035ISO/IEC 27037 (evidence handling)PDPL 151/2020 breach notification
Reporting is structured against these so the same investigation can answer a regulator, an insurer and a court without being rewritten for each.
Ready to secure your business?
Book a consultation with our engineers. Bring your architecture and your constraints — we'll tell you what we would do first, and why.
WHAT A CONSULTATION LOOKS LIKE
01
A conversation with an engineer
Not a sales call. Bring your architecture and your constraints.
02
A written gap summary
Prioritised, with what we would do first and why.
03
No obligation, no follow-up sequence
If it is not a fit we will say so on the call.
Not ready to talk? See the company facts — entity details, offices and our NTRA certification.
One inbox, answered by an engineer — not a routing queue.