Professional Services
Incident response: someone to call, and a plan to follow, once it has started.
How the first few hours go decides whether a breach costs you a day or a quarter. Defendrs works out what is happening, contains it, and gets you running again. We also stay for the less visible work that follows: forensics, notification, and insurance.
A 30-minute call. Bring a recent moment when something seemed wrong, and we will turn it into a response plan.
A crisis is a poor time to make decisions for the first time
The usual assumption is that when something goes wrong, somebody capable will step up and handle it. What tends to happen is that the days after a breach get spent on questions no one had settled. Whose phone rings first? Who speaks to the customers? Which backups can be trusted? Does the insurance policy apply to this at all?
An incident response plan is nothing more than those answers, worked out ahead of time and put in the right order. We write it with you. When the day comes, we work through it beside you.
What happens during a response
Confirm and contain
First we establish what is really going on. Then we cut it off by isolating the affected account, device, or mailbox, and we open an evidence log before any cleanup begins. Damage that has been contained is something you can explain and recover from. Damage that is still spreading can sink the business.
Investigate the scope
Two questions matter here: how the attacker got in, and what they reached. We trace the point of entry, determine what was accessed, and tell you plainly what we found. Your insurance carrier, your attorney, and your customers will all need that same account.
Restore in sequence
Systems come back from backups that have been tested, in an order that keeps the business working, and only once we have verified the attacker’s route in is closed. The pace is your call. We supply the checklist.
Report and revise
Each incident ends with a report in plain language covering what broke, what held up, and what will change. We update the plan and fix what the report found, so the next event is smaller and shorter.
Five things to have ready before anything goes wrong
Backups that are tested and isolated, out of reach of ransomware.
A list of the data, systems, and logins you have, so there is an answer when someone asks what the attacker reached.
A written threshold for what counts as an incident worth declaring.
A contact number for each advisor (security, legal, and insurance) that someone will answer at 2 a.m.
Message templates for staff, clients, and regulators, drafted ahead of need.
Have the number saved before you need it.
For most companies, the incident itself is the first time they meet their response team. Arrange the introduction earlier.