Cybersecurity
Incident Response & Recovery Readiness
Overview
The worst time to write an incident plan is during an incident. We help you prepare, rehearse and — if it happens — respond and recover.
Outcomes we measure
- Incident response plan tested in the last 12 months
- Time to contain an incident
- Recovery time against objectives
- Lessons learned closed out
Problems we solve
Sound familiar?
- 01
There is no written plan, or the plan has never been tested.
- 02
Backups exist but nobody has proven you can restore from them.
- 03
During an incident it is unclear who decides, who communicates and who calls the insurer.
What we deliver
Concrete deliverables, not slideware.
Incident response plan and playbooks
Roles, decision rights, communication plans and playbooks for ransomware, data leaks and account compromise.
Tabletop exercises
Realistic scenarios for leadership and technical teams, with a report on gaps found.
Response support
Hands-on help to triage, contain, investigate and recover, coordinated with your team, insurer and counsel.
Recovery readiness
Backup and restore testing, recovery objectives and resilient architecture recommendations.
How it works
From first call to production.
- 01
Assess readiness
Review plans, logging, backups and decision-making.
1–2 weeks
- 02
Plan and playbooks
Write or update the plan and key playbooks.
2–4 weeks
- 03
Exercise
Run tabletop exercises and capture improvements.
1 day per tabletop
- 04
Respond and recover
Support during real incidents, then a post-incident review.
As needed
Tech & frameworks
Tools we use — in your stack.
- NIST SP 800-61
- NIST CSF 2.0
- SANS PICERL
- Velociraptor
- KAPE
- Microsoft Defender XDR
- CrowdStrike
Related projects
Where we've done this.
Case studies
Case studies for this service are being prepared. Ask us for references on a call.
FAQ
Frequently asked questions
Cybersecurity
Related services
Security Assessment & Penetration Testing
Vulnerability assessment and penetration testing (VAPT) across applications, APIs, cloud and internal networks.
Cloud Security & Posture Management
Cloud security posture reviews, hardening and continuous guardrails across AWS, Azure and GCP.
AI & LLM Security
LLM red-teaming, prompt-injection defence, tool-permission scoping and model governance for AI applications and agents.
Scope it with a senior practitioner
Book a 45-minute security readiness call.
Where you are, what to fix first, and what it would take.