Incident response
Incident Response and Retainers
Something has gone wrong, or you want a team ready for when it does. We respond fast, contain the damage and get you back to business.
Overview
What it is
When an incident hits, the first hours matter most. We help you contain it, understand what happened and recover, calmly and methodically, without the panic.
A retainer puts our team on standby before anything happens, with agreed response times and a plan already in place. When something does go wrong, you are not starting from a cold stop.
Who it is for and what you get
Who it is for
- Organisations dealing with an active incident right now
- Teams that want a response plan and a team on standby
- Businesses with a cyber insurance or contractual response requirement
- Anyone who has had a near miss and does not want to be caught out again
What you get
- Hands-on help to contain and recover from the incident.
- A clear account of what happened, how and what was affected.
- Practical steps to stop it happening again.
- With a retainer: agreed response times, a plan and a team who already know you.
Our process
How the engagement runs
- 01
Triage
We work out what is happening, how serious it is and what needs to happen first.
- 02
Contain
We stop the incident spreading and limit the damage, working alongside your team.
- 03
Recover
We help you get systems back safely and make sure the attacker is out.
- 04
Learn
We give you a clear account and the steps to reduce the chance of it happening again.
FAQs
Frequently asked questions
We think we are under attack right now. What do we do?
Email our 24/7 SOC at [email protected] straight away and we will respond. Try not to power systems off before speaking to us, as that can destroy evidence we need.
What is a retainer and do we need one?
A retainer puts our team on standby with agreed response times and a plan ready to go. It means faster help and no scramble to find a provider mid-incident. It is strongly recommended if an outage would seriously hurt you.
Can you work with our IT provider?
Yes. We regularly work alongside in-house teams and third-party IT providers during an incident and set clear roles so everyone pulls together.
Do you help with reporting to the ICO?
We help you understand what happened so you can meet your reporting duties. We are not your legal adviser, but we give you the clear technical facts you need to report accurately and on time.
Related services
You might also need
Security Consultancy
Practical, vendor-neutral advice that moves your security forward.
Learn moreRed Teaming and Social Engineering
A full-force, goal-based attack on your people, processes and buildings.
Learn moreCloud Security Hardening
Lock down your cloud tenancy against the attacks that actually land.
Learn moreGet started
Ready to scope your incident response and retainers?
Tell us about your organisation and we will recommend the right approach. Quote only, no hard sell.