The visible flaw is not always the starting point
The first symptom noticed rarely points to where the attack really began.
If only the consequence is dealt with, the root cause can stay hidden.
Forensics
Digital forensics after a security incident.
We find out how the attacker got in, what they reached and what needs to be closed so they cannot come back.
Business risk
After an incident, guesswork is expensive.
When a system is compromised, decisions have to be made quickly – about containment, notification and recovery. Without a clear picture of what happened, those decisions rest on assumptions.
Digital traces disappear easily
Rebooting, reinstalling or a hasty recovery can wipe out important traces.
Preserving evidence properly in the first hours can be decisive.
Reporting deadlines do not wait
Under the GDPR, an incident involving personal data generally has to be reported to the authority within 72 hours, and organisations covered by NIS2 must send an early warning within 24 hours.
That requires knowing what is affected – documented findings help.
Dealing with a suspected incident? Talk to us before you clean up.
Request a consultationMethodology
How we approach a forensic investigation.
We combine forensic analysis with an attacker’s perspective. Knowing how systems are broken into helps us reconstruct how it happened in your environment.
- Timeline of observed events
- Affected systems and accounts
- Investigation goals and constraints
- System, application and network logs
- File system and memory artefacts
- Indicators of compromise
- Timeline of the incident
- Root cause
- Recommendations to prevent recurrence
- Disk and memory images where needed
- Log collection from relevant sources
- Documented handling of evidence
- Initial entry point
- Movement between systems
- Data and systems accessed
Insights
Incident insights.
What real incidents teach about attack paths, detection and response.
Incident response
Assessment after a data breach: too little, too late?
An intrusion into a company network can lead to a data breach. All the data is still in place, yet the loss is huge. What can we do to prevent this?…
Read more
Ransomware
Protection against ransomware
A ransomware attack can have a catastrophic impact on your business and usually results in serious financial loss. You can protect your business!…
Read more
Consultation
Security starts with a conversation.
No sales pitch – just a focused conversation about your business continuity and operational risk.