Retainer clients receive a 1-hour SLA for initial analyst engagement, 24/7/365. Emergency activations — including weekend and holiday callouts — are covered under all retainer tiers. Non-retainer emergency engagements are typically scoped and mobilised within 4 hours of initial contact, subject to availability.

We advise on negotiation strategy and can facilitate communication, but we strongly prioritise restoration from backup where viable — avoiding ransom payment entirely. Our playbook includes a pay-vs-restore decision matrix that evaluates backup integrity, decryptor availability, exfiltration risk, and business continuity impact before any negotiation is considered.

Evidence is acquired following ACPO/NIST 800-86 guidelines — disk images are created with write-blockers, memory dumps are captured using validated tooling, and all artefacts are SHA-256 hashed on collection. A timestamped chain-of-custody ledger is maintained throughout and provided with the final report to support any legal or regulatory proceedings.

Retainer tiers include a reserved analyst block (hours/year), defined SLAs by severity (P1–P4), annual tabletop exercises, quarterly threat briefings, and access to our playbook library for your top threat scenarios. Unused retainer hours roll over on annual renewal, and additional hours can be drawn at a pre-agreed rate without new procurement cycles.

A standard engagement covers initial triage and scoping, evidence collection and preservation, attacker timeline reconstruction, containment and eradication, recovery validation, and a written post-incident report. Scope expands based on environment size, number of affected hosts, presence of data exfiltration, and regulatory notification requirements.

Every containment action is risk-tiered before execution. Host quarantine, VLAN isolation, and credential revocation are staged in order of blast-radius impact, and each step includes a documented rollback path. For critical production systems, analysts execute containment in coordination with your operations team to minimise unplanned downtime.

Yes. For environments without existing telemetry, our team deploys lightweight forensic collection agents to affected hosts within hours of engagement. We collect Windows event logs, prefetch, USN journals, browser history, and network flow data. While response times are faster with mature tooling in place, we can operate effectively from native OS artefacts alone.

We assess notification obligations in parallel with technical response. Our team maps confirmed or suspected data access against applicable regulations — GDPR, PCI DSS, HIPAA, NIS2, CCPA — based on data classification, affected systems, and evidence of exfiltration. Where required, we produce regulator-ready breach notification drafts within the applicable disclosure window.