What should we do in the first hour, before anyone arrives?

Three things that are safe in every scenario. Disconnect the affected machine from the network but do not power it off, because shutting down destroys memory-resident evidence permanently. Stop anyone deleting, reinstalling or cleaning anything, however tempting it looks. And change passwords from a different device that is known to be clean, starting with email and the domain registrar. Then write down what you have already done and at what time.

Can you tell us who did this?

Almost certainly not, and any supplier who promises attribution during an active incident is overselling. Identifying an attacker is a matter for law enforcement and the platforms involved, with data we do not have access to. What can be established is when they got in, how, what they reached and what left — which is what your insurer, your regulator and your customers actually need.

Will you notify the regulator for us?

No. Under GDPR the clock on a notifiable personal data breach starts the moment you become aware of it and it is a short one, other jurisdictions run their own clocks and thresholds, and whether an obligation is triggered at all is a legal judgement that belongs to your counsel. What we do is produce the factual record they need to make it, at the speed the clock requires, and we will tell you the moment we see something likely to trigger it.

Can you confirm that no customer data was taken?

Usually not, and this is the most dangerous sentence in the field. What a report can honestly say is what the available evidence showed and over what period — for example that no evidence of data leaving was found in the logs available, and that those logs covered only a limited period. Writing anything stronger than the evidence supports is what gets an insurance claim refused later, or worse, contradicted in front of a regulator.

How is the work billed when nobody knows how long it will take?

Hourly at $150–$400/hr, with the range reflecting the seniority and hours involved rather than a menu. Emergency rates are higher because everything else is dropped to take the call, and out-of-hours work is a real cost. You get a written estimate of hours after the first assessment, and a standing agreement that we tell you before crossing a threshold rather than presenting a number at the end.

Can we arrange this in advance rather than during a crisis?

Yes, and it is by far the better purchase. A retainer fixes a response time so you are not negotiating terms at three in the morning, and the preparation work behind it — an incident response plan, a contact list, a runbook, a backup restore actually tested rather than assumed, and one tabletop exercise a year — is what determines whether an incident lasts two days or two weeks. It is quoted separately from emergency response.

Cybersecurity

Incident response and forensics

Containment that does not destroy the evidence, an investigation that establishes what actually happened, recovery from a clean source, and a written record your insurer and lawyer can use.

From: $150–$400/hr
Typical time: emergency
Usually bought by: Breached companies

What this actually solves

By the time this call is made, the decision has already been taken out of the company's hands. Systems are encrypted, or a payment has gone somewhere it should not have, or an attacker has been sitting in a mailbox for weeks and somebody has just noticed. This is not a purchase in any normal sense. It is a survival action, and very often the call is placed by the company's insurer or its lawyer rather than by the owner.

The problem being solved is not only the technical one. It is that a set of clocks have all started at once and they conflict. Operations need to be restored today. Evidence needs to survive until it is collected properly. A regulatory notification window may be running. An insurance policy will require the loss to be substantiated. And every instinct in the building — reinstall the server, wipe the laptop, delete the suspicious account — destroys something one of those other clocks depends on.

That conflict is the whole reason this is a specialist engagement. Restoring a business quickly is not difficult. Restoring it quickly while keeping the record intact enough that an insurer will pay, a regulator will accept the account and a court would not dismiss it, is a different discipline, and the choices that determine it are made in the first few hours.

How a response runs

Triage and containment without destroying evidence. Establish the scope, isolate affected systems from the network without powering them down, stop any cleanup already underway, and get credentials changed from clean devices — starting with email, the domain registrar and anything holding money. Within the first hour of engagement.
Preserve the evidence. Disk images, memory where it is still available, and logs from every relevant source before retention windows expire — with a chain of custody recorded so the material is defensible later. Log retention is usually the constraint that decides how much of the story can ever be told, and it is shorter than people assume. Four to twelve hours, running alongside containment.
Investigate. When they got in, how, where they moved, what they touched, and whether anything left. Documented as findings with the evidence attached, and separated clearly into what is established, what is inferred and what is unknown. One to five days, depending on scope and how much log history survives.
Eradicate and restore from a clean source. Rebuilt rather than cleaned wherever possible, restored from backups verified as predating the compromise, and brought back in an order that does not reinfect what has already been recovered. One to four days, overlapping the investigation.
Support the notification decision. The factual record your lawyer needs to judge regulatory obligations, in the format and on the timescale those obligations require. The legal call is theirs; the facts are ours. Continuous, driven by your legal clock.
Lessons learned and hardening. A written account of what happened, what was done, what remains unknown and why, and the specific changes that would have prevented or limited it. This is the document that gets read months later, so it is written to survive being read months later. Three to five days after recovery.

What moves the price

The work is billed at $150–$400/hr on an emergency basis rather than as a fixed project fee, and three things determine the hours.

How many hours, and at what hour of the day. The real drivers are the size of the estate, how many systems have to be imaged and examined, and how much of the work falls outside normal working hours. An incident affecting one mailbox and one laptop is a fundamentally different number of hours from one spanning a domain, a file server and a cloud tenancy.

Whether evidence still exists when we arrive. A company that isolated rather than wiped, and whose logs are retained for a reasonable period, is investigated efficiently. Where somebody has already reinstalled the affected server, the work shifts to reconstructing a story from fragments — which takes longer, costs more and delivers a weaker answer.

How much recovery is included. Establishing what happened and rebuilding the business are two bodies of work. You may have your own developers to carry the rebuild once the investigation has released the systems, or you may need both. The second is substantially more hours than the first.

What usually goes wrong

Everything is cleaned in the rush to help. The most common and most costly error, and it is usually committed by someone competent trying to be useful. The server is reinstalled, the site comes back within hours, everyone is relieved — and now nobody can establish whether data left the business. The insurance claim fails for want of evidence, the regulatory notification cannot be answered honestly, and the customer question cannot be answered at all.

The machine is powered off. It feels like the safest possible action and it permanently destroys everything held in memory — running processes, network connections, credentials and in some cases the only copy of the keys involved. Isolate from the network, leave it running, and let whoever images it decide when it goes down.

Something unprovable is written into the report. The phrase to fear is that no customer data was accessed. Unless there is positive evidence for it, that sentence is a liability that will be produced later by someone with more time to read it than you had to write it. The defensible version states what was examined, what period it covered, and what was and was not found — which is less comforting on the day and holds up on every day after.

See where the site stands before you brief anyone.

If the site is already live, start from what it scores rather than from a guess. The audit reports what it checked, what it found, and — the part most tools leave out — what it could not check, and why.

See the website audit Talk about this work

Questions people ask before they commit.

What should we do in the first hour, before anyone arrives?: Three things that are safe in every scenario. Disconnect the affected machine from the network but do not power it off, because shutting down destroys memory-resident evidence permanently. Stop anyone deleting, reinstalling or cleaning anything, however tempting it looks. And change passwords from a different device that is known to be clean, starting with email and the domain registrar. Then write down what you have already done and at what time.
Can you tell us who did this?: Almost certainly not, and any supplier who promises attribution during an active incident is overselling. Identifying an attacker is a matter for law enforcement and the platforms involved, with data we do not have access to. What can be established is when they got in, how, what they reached and what left — which is what your insurer, your regulator and your customers actually need.
Will you notify the regulator for us?: No. Under GDPR the clock on a notifiable personal data breach starts the moment you become aware of it and it is a short one, other jurisdictions run their own clocks and thresholds, and whether an obligation is triggered at all is a legal judgement that belongs to your counsel. What we do is produce the factual record they need to make it, at the speed the clock requires, and we will tell you the moment we see something likely to trigger it.
Can you confirm that no customer data was taken?: Usually not, and this is the most dangerous sentence in the field. What a report can honestly say is what the available evidence showed and over what period — for example that no evidence of data leaving was found in the logs available, and that those logs covered only a limited period. Writing anything stronger than the evidence supports is what gets an insurance claim refused later, or worse, contradicted in front of a regulator.
How is the work billed when nobody knows how long it will take?: Hourly at $150–$400/hr, with the range reflecting the seniority and hours involved rather than a menu. Emergency rates are higher because everything else is dropped to take the call, and out-of-hours work is a real cost. You get a written estimate of hours after the first assessment, and a standing agreement that we tell you before crossing a threshold rather than presenting a number at the end.
Can we arrange this in advance rather than during a crisis?: Yes, and it is by far the better purchase. A retainer fixes a response time so you are not negotiating terms at three in the morning, and the preparation work behind it — an incident response plan, a contact list, a runbook, a backup restore actually tested rather than assumed, and one tabletop exercise a year — is what determines whether an incident lasts two days or two weeks. It is quoted separately from emergency response.

Often taken together.

Start with the brief, not the invoice.

Send what you are trying to achieve. You get a written scope, a price and a date — or an honest “this is not the right service for that”.

Talk about Incident response & forensics All Cybersecurity services