When something has gone wrong, facts first.

Response that keeps its evidential value

The first hours of an incident decide two things at once: whether the damage spreads, and whether anyone will ever be able to prove what happened. Logs rotate, attackers clean up, and well-meaning IT staff overwrite the record while trying to help. Our response preserves first: endpoint artefacts, cloud audit trails, network records and persistence mechanisms, captured before containment actions destroy them.

The output is a factual account a board, insurer or regulator can act on: the initial access, the movement, the duration, and a defensible statement of which data was viewed or taken. Where the matter later becomes litigation or a claim, the evidence is already in a condition to support it.

Incidents we investigate

• Business email compromise and payment-diversion fraud.
• Ransomware: scope, entry point and data-theft assessment.
• Unauthorised access to systems or accounts, internal or external.
• Suspected data loss discovered after the fact.

Frequently asked

Should we contain the incident before calling anyone?

Isolate affected systems where safety demands it, but avoid wiping, rebuilding or running scans first. Containment done carelessly destroys the record of what happened; a short call before irreversible steps usually saves the evidence.

Can you tell whether data was actually taken, not just accessed?

Frequently, yes. Cloud audit trails, transfer records and endpoint artefacts distinguish viewing from copying in many scenarios, which is exactly the distinction regulators and insurers ask about.