The response
Five phases, one continuous bridge
Our playbook maps to NIST 800-61 and is rehearsed weekly. You always know what is happening now and what happens next.
- 01
Engage
Hotline answered by a senior responder. Scope, legal and comms bridge established within the first 15 minutes.
- 02
Contain
Forensic collectors deployed, attacker access severed, identities reset and lateral movement blocked.
- 03
Eradicate
Root cause confirmed, persistence removed, malicious infrastructure blocked and telemetry gaps closed.
- 04
Recover
Clean rebuild and staged restoration, with hardening and monitoring in place before hand-back.
- 05
Report
Executive and technical reporting, regulator-ready timeline and a prioritised roadmap so it does not repeat.