Cyber Defense & Managed Security

Incident Response & Digital Forensics

Support incident investigation, evidence preservation and decisions that help contain the business impact of a cyber incident.

Start your enquiry

SERVICE IN DETAIL

From the first assessment to practical outcomes

Who this service is for

Organisations investigating a suspected cyber incident or preparing recovery decisions with technical and management teams.

How we work

  1. Triage & evidence preservation

    Affected systems, incident timeline, available evidence and chain of custody

    Establish the incident owner, affected services and immediate business impact. Agree authority and communication channels, then preserve available evidence with documented handling and collection priorities.

  2. Investigation & containment

    Entry points, attacker activity, affected identities and containment options

    Analyse relevant logs, endpoints and other authorised evidence to build a timeline and assess affected assets. Coordinate containment choices with the customer, balancing evidence preservation and operational needs.

  3. Recovery & lessons learned

    Forensic findings, recovery checks and a prioritised post-incident roadmap

    Support restoration priorities and check the agreed recovery evidence. Deliver a factual incident account, remaining uncertainties and improvement actions so technical teams and management can make informed decisions.

What you receive

  • Incident scope and evidence inventory
  • Investigation timeline and containment recommendations
  • Recovery priorities and lessons-learned report

Relevant frameworks and guidance

Before we begin

We confirm the scope, responsibilities, evidence, timetable and deliverables in the proposal. The activities above are tailored to the systems and objectives agreed with your organisation.

Discuss your scope

Specialist services

Incident Response Planning & Team Readiness

Build incident response plans, roles and escalation procedures so teams know how to coordinate when an incident occurs.

View scope, process and deliverables

Who this service is for

Organisations building a management framework, preparing for customer requirements or improving an existing programme.

How we work

  1. Assessment & gap analysis

    Critical services, incident scenarios, team structure and escalation dependencies

    Interview process owners, examine the current documents and sample supporting records. Identify gaps against the agreed framework and distinguish missing controls from controls that lack operating evidence.

  2. Implementation roadmap

    Incident classification, playbooks, evidence handling and communication procedures

    Prioritise actions by business risk and dependencies. Work with your owners on policies, procedures, responsibilities and practical evidence templates, then support adoption through agreed working sessions.

  3. Readiness & improvement review

    Response plan, contact matrix and readiness validation through an agreed walkthrough

    Review implementation evidence, discuss open issues and confirm ownership of remaining actions. Where formal certification or external assessment is needed, prepare the organisation for the appropriate independent assessment process.

What you receive

  • Gap assessment and prioritised action register
  • Agreed policies, working templates and implementation roadmap
  • Readiness summary and remaining actions for management

Relevant frameworks and guidance

Discuss this service
LET’S UNDERSTAND YOUR NEEDS

Tell us what
you need.

Answer the service-specific questions, review your summary, and send your request to our team.

A high-level summary is enough. Please do not include passwords, payment card data or confidential system evidence.

Read our privacy notice

For urgent matters, call 091 003 4852

Discuss your requirements directly with our team.

Contact our team

Related services

Cyber Defense & Managed Security

Managed Detection & Response (MDR)

Combine endpoint telemetry and expert investigation to detect threats and coordinate containment within agreed responsibilities.

↗