Incident Response
Advanced investigative services during a cybersecurity event, to establish what happened, what allowed it, and what to do about it
Suspect you are experiencing a cybersecurity incident? Request Assistance or call us at (844) ORB-FIRE (672-3473)
Here when you need us
Our Incident Response service takes command when something has happened. We establish what occurred and how, coordinate with your legal, insurance, HR, and finance people, work with law enforcement where that matters, and leave you with a defensible account of it.
These are advanced investigative services during a cybersecurity event. The first job is to establish confidently whether a compromise has actually happened, and then the chain of events that led up to it and perhaps allowed it. You do not have to be certain anything is wrong before you call.
Incident Response overview (PDF)Benefits
- Defensibility in the event of post-incident scrutiny
- Minimized financial loss, operational disruption, and reputational damage
- Satisfied regulatory mandates
Features
Experienced people running the response, and a record that holds up when someone asks what happened.
- Expert-led incident command and coordination
- Collection and analysis of evidence, logs, artifacts, and open source intelligence
- Identification of indicators of compromise
- Detailed forensic investigation
- Coordination with legal, human resources, finance, and every other company function
- Coordination with law enforcement, including the FBI and state and local police
What happens when we call?
We take incident command. That means establishing what actually happened and how, before anybody makes an irreversible decision about it, and then running the response: collecting and analyzing evidence, identifying indicators of compromise, and coordinating everyone who needs to act. You are not left deciding what to do next while the business is down.
Is this only for ransomware?
No. Ransomware is the one people expect, but financial fraud and data breach bring the same problem: something has happened, nobody is certain what, and decisions have to be made quickly with legal and financial consequences attached. The response is the same discipline whichever it turns out to be.
Do you work with our lawyers and our insurer?
Yes, and with your HR and finance people too. Most of the hard calls in the first forty-eight hours are not technical ones, and they are made badly when each party is working from a different account of events. Coordinating that is part of incident command rather than something handed back to you.
What do we have at the end?
A detailed forensic findings report and recommendations: what happened, how it happened, and what allowed it. That record is what makes your position defensible if the incident is scrutinized afterwards by a regulator, an insurer, a customer, or a court.
Tell us about your business.
A half-hour conversation about what you're being asked for and where you actually stand. If we can help, you'll have a proposal usually within a day.
Not ready to talk? Check your readiness in five minutes and see where to start.