Contain the incident. Preserve the evidence. Plan recovery.
We support businesses with incident readiness, technical investigation and coordinated recovery planning. Our incident response and digital forensics services help your team establish what happened, what may be affected and which actions to take next.
How the service works.
./incident-response.sh --phase scope --environment exampleIncident Response & Forensics services.
Incident readiness
Review escalation contacts, response authority, logging and recovery dependencies.
Investigation support
Scope affected assets, examine available evidence and build an incident timeline.
Evidence handling
Document collection, integrity checks, access and chain-of-custody requirements.
Recovery planning
Coordinate containment, restoration validation and improvements following the incident.
Coordinate investigation and recovery.
Containment and evidence preservation need to be coordinated. We agree responsibilities with your team, record the basis for decisions and separate verified findings from open questions. Recovery planning considers affected identities, dependencies and the checks needed before systems return to normal operation.
What you receive.
- Incident scope and investigation timeline
- Evidence inventory and technical findings
- Recovery recommendations and lessons learned
How an engagement begins.
We begin with a scoping conversation about your environment, priorities and existing tools. We agree access, responsibilities, milestones and acceptance criteria before delivery. Our team then carries out the assessment, design or implementation work in scope, reviews findings with you and prepares a practical handover.
Your proposal defines the final deliverables, access requirements, service hours, response commitments and ongoing support responsibilities. Work can be phased around your priorities and approved change process.
Common questions.
How do we request help during an incident?
Use the contact page or call our team to confirm availability and the immediate scope. Do not send passwords, sensitive logs or evidence through a public enquiry form; we agree a suitable transfer method during intake.
How can you improve our incident readiness?
We review escalation contacts, response authority, logging and recovery dependencies. The review records scope, dependencies and the evidence needed before implementation decisions are made.
How do you determine the scope of an incident?
We scope affected assets, examine available evidence and build an incident timeline. Findings are reviewed with the responsible team so access, operational impact and ownership are clear.
How is digital evidence handled during an investigation?
We document collection, integrity checks, access and chain-of-custody requirements. Implementation follows agreed acceptance criteria and approval points, with limitations documented.
How do you support recovery and post-incident improvement?
We coordinate containment, restoration validation and improvements following the incident. Handover includes the responsibilities and review actions needed to keep the work useful over time.
What deliverables are included in incident response & forensics services?
The proposed deliverables include incident scope and investigation timeline; evidence inventory and technical findings; recovery recommendations and lessons learned. The final statement of work defines the format, acceptance criteria and responsibilities for each deliverable.
How is the work tailored to our business?
Containment and evidence preservation need to be coordinated. We agree responsibilities with your team, record the basis for decisions and separate verified findings from open questions. Recovery planning considers affected identities, dependencies and the checks needed before systems return to normal operation.
How do we get started with this service?
We first discuss your objective, current environment and operational constraints. The engagement follows scope incident, preserve evidence, analyze activity, and validate recovery. Access requirements, milestones and approval points are agreed before delivery.
Can you work with our internal team or current providers?
Yes. We agree a responsibility matrix and communication process so your engineers, security team and service partners know who owns decisions, changes and follow-up actions. Ongoing support is included where specified in the agreed engagement.
What determines the project timeline and cost?
Scope, environment size, access readiness, integration complexity and the level of implementation or ongoing support determine the proposal. We review those factors with you and agree milestones and fees before work begins.
Let’s plan the right service for your business.
Tell us what you need to assess, build or improve. We’ll help define the scope and a practical next step.