Working out what happened
Logs, systems and timelines, read to establish what actually occurred rather than what the first alert suggested. The first story is wrong more often than not.
Home/Services/Incident support
Incident support
Help working out what happened, how far it reached, and what to close first. Calm hands on a bad day, and a straight account afterwards of how it started.
What gets tested
Establishing the reach
Which accounts, which systems, which data. The question that decides both your next move and, frequently, what you are legally obliged to report.
Deciding what to close first
Containment in an order that does not destroy the evidence you need, and does not tip off someone still inside before you are ready.
Afterwards
A written account of how it started and what would have caught it earlier. Aimed at the people who have to prevent the next one, not at assigning blame for this one.
How it runs
-
01
Call
Tell me what you are seeing. We work out in that conversation whether you need me, someone with a different specialism, or nobody at all.
-
02
Stabilise
Agree what to preserve before anything is rebuilt, and what to shut down now. Evidence is easy to destroy in the first hour by accident.
-
03
Establish
Reconstruct the sequence and the reach from what the systems actually recorded, separating what is known from what is inferred.
-
04
Account
A written account: what happened, what it reached, what was done, and what would have caught it earlier.
What you get
- A direct line to one person who has the context, for the duration.
- A containment order that preserves evidence rather than destroying it.
- A clear separation, in writing, between what is established and what is inferred.
- A timeline you can hand to your own leadership, and to a regulator if it comes to that.
- A plain account afterwards of how it started.
- PERSONALISE: state your availability honestly — hours, expected response time, and whether this is retainer-only or also available cold.
What this is not
- Not a 24/7 emergency service unless you have arranged one. Do not let this page be your plan; agree how to reach me before you need to.
- Not legal or regulatory advice. I will establish the facts you need in order to take advice. Whether something is reportable is a question for a lawyer.
- Not crisis communications. What you tell customers and press needs someone who does that work.
- Not a rebuild. I will tell you what to close and what to preserve; restoring the environment is your team or your provider.
Common questions
We think something is happening right now. What should we do first?
Get in touch, and in the meantime do not rebuild anything yet. Reimaging the affected machine is the most common way the answer to "how did they get in" is destroyed in the first hour.
Preserve logs, write down what you have already changed and when, and keep that record going.
Do we need a retainer, or can we call cold?
PERSONALISE: answer this one plainly. Availability is what people are really asking about, and a vague answer here costs you the engagement.
How does this work with our insurer?
Check your policy before you engage anyone. Cyber policies often name an approved response provider, and using someone else can affect the claim.
If your policy has that condition, follow it. I would rather you kept your cover.
Can you tell us whether data was taken?
Sometimes. It depends entirely on what your systems recorded, which is usually decided long before the incident.
Where the evidence does not support a conclusion, I will say so rather than produce a comfortable one. "No evidence of exfiltration" and "no exfiltration" are different sentences, and only one of them is usually true.
What if it turns out to be nothing?
That happens, and it is a good outcome. You get a short written account of what it actually was, which is worth having the next time the same alert fires.
Start a conversation
If something is happening now,
say so in the first line.
[email protected]
Replies within one working day. Dutch or English.