Incident Response

The retainer puts the paperwork, pricing, and response commitments in place before an incident: a signed agreement, pre-negotiated rates, SLA response times, and an onboarding pass over your environment so we are not learning your network mid-crisis. It also includes readiness work such as plan development and tabletop exercises. The emergency path is for organizations that call us during an active incident without a prior relationship; we can move quickly, but the first hours are spent on scoping and access instead of response.

You get an immediate scoping call with a senior responder, not an intake queue. We establish what is known, what systems are affected, and what has already been done, then move into triage: stabilizing the environment, preserving evidence, and building a containment strategy. From there we coordinate with your IT team, counsel, and insurer, and we stay engaged through eradication, recovery, and the post-incident report.

No. Your IT team and MSP know the environment; we bring incident command, forensic discipline, and regulatory context. We direct the response, make containment recommendations, and handle the workstreams your team is not staffed for, such as evidence preservation and notification analysis, while your staff execute changes in the systems they know.

Readiness. The retainer includes incident response plan development or refresh, scenario playbooks, tabletop exercises, and an annual readiness review. Many clients treat the retainer as an insurance policy and a preparedness program in one: the plan and exercises satisfy auditor and customer requirements today, and the SLA is there if you ever need it.

We design a scenario around your actual environment (a compromised executive mailbox, a leaked credential reused in your cloud console, a third-party breach touching your data) and walk your leadership and technical teams through the decisions hour by hour. The output is a findings report with concrete gaps and fixes. Most organizations run one or two per year; frameworks such as SOC 2, HIPAA, and CMMC expect incident response testing on a regular cadence.

Forensics answers the factual questions that notification decisions depend on: what was accessed, when, and by whom. Our incident response and digital forensics services work as one engagement when needed; evidence is preserved from the first hours so that scope determinations hold up with regulators, insurers, and counsel. See our digital forensics service for the investigation side of the house.