Incident response retainer
Contracted availability in case of a security incident, so that when something goes wrong you already know who to call.
What we take on in an incident
From containing the attack to working systems
The retainer covers these three tasks.
Stopping the spread
We stop the attack from spreading across the affected systems. Disconnecting systems is not the default response; how far we isolate depends on how far the damage reaches.
Remediation
We remediate the incident in the affected environment. When compromised credentials are replaced, timing matters: a hasty password reset made too early can tip off the attacker that they have been spotted.
Recovery
We restore the affected systems to a working state. Whether this takes a few days or several months depends on whether an isolated, tested backup exists.
How the retainer works
Before, during, and after
We get to know your environment before an incident, because there is no time for it once one is under way.
-
Preparation
We agree in advance on how to reach us and how we respond, and we get to know your environment so that we do not start from zero when something happens. Under a custom agreement we also offer availability outside business hours and a fixed response time.
-
During the incident
Once alerted, we step in as agreed and carry out the remediation and recovery work.
-
Closing the incident
We summarize in writing what happened and what we did. The incident shows what was missing from your defenses, and our recommendations address those gaps.
Deliverables
What you get under the contract
committed items
- Availability and response procedure agreed in advance
- Getting to know your environment in advance, so we do not start from zero when something happens
- Remediation and recovery work during the incident
- Post-incident report and recommendations
Related services
What is decided before the incident
Incident response goes faster the earlier the attack is detected and the more reliable the restore is.
Backup and disaster recovery
Review or design of your backup system, so that after an incident you can actually restore from it.
Endpoint protection (EDR/XDR)
Behavior-based protection on workstations and servers, with managed detection and response (MDR) from the vendor.
Log collection and alerting (SIEM)
While doing reconnaissance, an attacker does things nobody does in normal operation. You can detect this if logs are collected and someone actually watches the alerts.
OT incident response protocol
In a plant the order of steps and the roles are different, so we build a separate procedure for the OT environment and have your team practice it.
Frequently asked questions
The questions we hear most
Does the retainer include digital forensics?
No, the service does not include a digital forensic investigation. If you have cyber insurance, the insurer often specifies which experts may be brought in, so it is worth checking your policy for this before an incident.
What should we do in the first hours, before we touch anything?
Do not shut the machines down: the traces in memory (running processes, network connections, sometimes the encryption key itself) are lost for good when they are powered off. You can disconnect them from the network, but do not cut the power. Do not start reinstalling either: if the evidence is overwritten, the entry point will not come to light, and the attacker can come back the same way. If email or chat may be compromised, switch to a separate channel, because the attacker may be reading how you plan your response. We set out the first day's tasks in order in our article The first 24 hours after a cyber incident.
When should we raise the alarm?
As soon as you suspect something. The later you call for help, the less evidence remains, and logs are usually rotated after a short retention period.
Should we pay the ransom in a ransomware attack?
Certainly not in haste. Paying guarantees neither recovery nor the deletion of stolen data, and in a number of cases it makes the organization a repeat target. This decision should only be made after assessing your ability to recover. We described how such an attack unfolds in our article Ransomware protection step by step.
