When it's already happened, every minute counts
Our DFIR team preserves evidence, contains the incident, and gets you back to operating — with reporting your board, insurer, or donor can actually use.
What happens the moment you call
Do this now, if you suspect a breach
Call the incident hotline before you do anything else. Avoid powering off affected systems unless instructed — this can destroy the volatile evidence we need to understand what happened.
0–15 min
Triage call, initial scoping, and evidence preservation guidance.
15–30 min
Responders begin remote evidence collection and containment planning.
30–45 min
Containment actions begin where authorised; stakeholders briefed.
45–60 min
Investigation scope confirmed; regular update cadence established.
Six capabilities, one response team
Evidence preservation
Chain-of-custody handling that stands up to legal and insurance scrutiny.
Containment & eradication
Stop the spread, remove the foothold, verify it's gone.
Root cause analysis
Understand exactly how the incident happened, not just what happened.
Forensic reporting
Written for insurers, boards, and donors — not just other engineers.
Ransomware & BEC playbooks
Tested response paths for the incidents we see most often in this region.
Retainer or emergency
A standing agreement with guaranteed response times, or scoped on the day.
From first call to closed incident
Triage & scope
We confirm what's affected, what evidence needs preserving, and what containment is possible immediately.
Contain & eradicate
We stop lateral movement, remove the attacker's foothold, and verify eradication before declaring the incident closed.
Investigate
Root cause analysis establishes exactly how access was gained and what was accessed.
Report & recover
You receive a forensic report suitable for your board, insurer, or donor, plus recommendations to prevent recurrence.
Retainer vs. emergency engagement
| Retainer | Emergency | |
|---|---|---|
| Response-time commitment | Guaranteed | Best-effort |
| Pricing | Pre-negotiated | Scoped at time of incident |
| Environment familiarity | Pre-onboarded | Scoped from scratch |
| Annual readiness review | Included | — |
| Available to non-retainer clients | — | Yes |
Business email compromise & invoice fraud
BEC and invoice-redirection fraud is one of the most common and costly incidents we see against remittance, trading, and finance-heavy organisations in this region. Attackers impersonate executives or suppliers, time messages around real payment cycles, and request urgent changes to bank account details.
- Investigation into how the compromise occurred and what was accessed
- Coordination with banks on fraudulent transfer recovery windows
- Hardening of email authentication and payment-verification process
Ransomware readiness
Our ransomware playbook covers isolation, negotiation-adjacent guidance, backup verification, and phased recovery — built from patterns we track through the Threat Response Team.
What you leave the engagement with
1
Named lead responder throughout
24/7
Hotline availability
1
Board/insurer-ready forensic report
What you receive
Forensic incident report
Technical findings, root cause, and timeline — formatted for insurers, boards, and donors.
Evidence package
Preserved, chain-of-custody logs and artefacts, retained per your retention policy.
Remediation roadmap
Prioritised recommendations to close the gap that allowed the incident.
Post-incident debrief
A walkthrough session with your team covering what happened and what changes.
Common questions
Set up a retainer before you need one
Guaranteed response times cost less to arrange in advance than at 2am during an active incident.