// CYBERSECURITY / INCIDENT RESPONSE & READINESS
When prevention fails, the first hours decide the damage.
Every organisation gets breached eventually, and most have an IR plan that has never been tested. We build the readiness, prove it with exercises, and stand ready to run a project-based response when an incident lands. All under your brand.
Start a readiness conversationMost clients have a plan they have never run.
Prevention buys time, not immunity. Sooner or later something gets through, and when it does the first hours set the cost: an average breach now runs into the millions, and the attacker has typically been inside for over a week before anyone notices. The uncomfortable part is that more than half of organisations have no tested response plan at all. A document in a shared drive is not a plan; it is an untested assumption. When the alert fires at 2am, the difference between a contained incident and a public catastrophe is whether the playbooks, the logging and the practice were in place beforehand, all of it under your client's name.
What we deliver.
IR Plan & Playbooks
A NIST SP 800-61 aligned response plan built for the client, not a template with their logo on it. Per-scenario playbooks for ransomware, business email compromise and data theft, with role cards that say who does what in the first hour.
Tabletop Exercises
Scenario-driven exercises run at two levels: a board-level session on decisions, disclosure and liability, and a technical walkthrough that pressure-tests the playbooks against a live attack chain mapped to MITRE ATT&CK.
Forensic Readiness
The logging, retention and evidence-handling that make a future investigation possible. We set the log sources and retention that matter, define chain-of-custody, and stand up DFIR tooling like Velociraptor and KAPE before anything goes wrong.
Compromise Assessment
A structured threat hunt to answer one question: is an intruder already inside? Memory forensics, endpoint telemetry and ATT&CK-led hunting across the estate, surfacing the dwell-time adversary that slipped past the controls.
Breach Response Engagement
When an incident lands, a project-based DFIR engagement: contain the blast radius, eradicate the foothold, recover cleanly, and reconstruct the timeline. Mobilised fast, run to a defined endpoint, delivered under your brand.
Post-Incident Review
The hardening that stops a repeat. A blameless review of root cause and response, a prioritised remediation plan, and the control and detection gaps closed so the same door does not open twice.
The cost of being unready.
How the options compare.
What your client gets from no plan at all, a generic MSSP retainer, or our team under your brand.
Incident response, answered straight.
01 Do you run a 24/7 SOC and monitor our clients around the clock?
No, and we are deliberate about that line. This offering builds the readiness and responds on a project basis: the plan, the playbooks, the exercises, the forensic groundwork, and a DFIR engagement if an incident hits. Ongoing detection and 24/7 monitoring is a different discipline. That lives in our MDR & XDR offering, or stays with the client's own team. We make sure that when the alert does fire, everyone knows exactly what to do.
02 What does a tabletop exercise actually deliver?
A facilitated simulation of a real incident, run without touching production. The board-level session walks leadership through the decisions that get made under pressure: when to disclose, when to pay or refuse, who speaks to regulators and customers. The technical session pressure-tests the playbooks against a live attack chain. You leave with a findings report, a gap list, and a plan that has been proven rather than assumed.
03 How does a breach-response engagement work?
It is a scoped project, not a subscription. When an incident is declared we mobilise a DFIR team: contain the blast radius, eradicate the attacker's foothold, recover services cleanly, and reconstruct the timeline for the board and the regulator. It runs to a defined endpoint, all under your brand. Where a partner wants to offer their clients a faster guaranteed start, we back a partner-run on-call retainer on a project basis, so you hold the relationship and we provide the responders.
04 What is forensic readiness in plain terms?
It is the unglamorous work that decides whether a future investigation is even possible. If the right logs were never collected, or rolled off after a week, the evidence of how an attacker got in simply does not exist. We set the log sources and retention that matter, define how evidence is captured and preserved so it holds up, and stand up DFIR tooling like Velociraptor and KAPE in advance. Done before an incident, not scrambled during one.
05 What are the NIS2 and DORA incident reporting timelines?
They are tight. NIS2 Article 23 requires an early warning within 24 hours of becoming aware of a significant incident, a fuller notification inside 72 hours, and a final report within a month. DORA sets comparable clocks for major ICT incidents in financial entities. We build the classification criteria, the notification templates and the evidence trail into the plan, so the regulatory clock is something you can meet rather than discover too late.
06 How is a compromise assessment different from a penetration test?
A penetration test asks whether someone could get in. A compromise assessment asks whether someone already has. The first probes your defences from the outside; the second hunts through endpoint telemetry, memory and logs for evidence of an intruder already operating inside the estate. Given the median attacker dwells for over a week before detection, the question is rarely hypothetical. We run the hunt and tell you straight.
Tell us what your clients need.
A tri-cloud migration. A 200-site SD-WAN rollout. A security architecture before NIS2 hits. An AI system your client is asking about next quarter. We scope it, staff it, and deliver it under your brand. One conversation tells us if we are the right team.