Incident Response
Containment, eradication, and recovery when something has already happened. We arrive, establish the real scope, and remove the adversary — without destroying the evidence along the way.
- Who it is for
- Any organization that suspects an active intrusion, ransomware, internal fraud, or data exfiltration.
- Typical duration
- Immediate activation
- Frameworks
- NIST SP 800-61r3SANS PICERLISO/IEC 27035
If you suspect an incident in progress, write to ventas@wakops.com with INCIDENT in the subject line. We prioritize the response.
The first hours decide the outcome
In most incidents we handle, the avoidable damage was not caused by the attacker — it was caused by the improvised reaction of the first few hours. Servers powered off, wiping the volatile memory that held the evidence. Credentials half-rotated, alerting the adversary without removing them. Backups restored onto the same vulnerability that allowed entry, with reinfection within days.
Before you call: four things
If you are reading this during an incident:
- Do not power off compromised systems. Isolate them from the network — pull the cable or move the segment — but keep them running. RAM holds evidence that is lost on shutdown.
- Do not delete anything, and do not let the antivirus “clean” the malware yet. We need to see what it did and since when.
- Preserve logs now. Many systems rotate logs within days. Pull them and store them somewhere separate.
- Communicate out of band. If the adversary is inside, they are probably reading corporate email and internal chat. Coordinate the response over a different channel.
Working with third parties
We work alongside your cyber insurer, your legal counsel, and, where appropriate, the authorities. The report is structured from the outset to support a claim and to answer a regulatory request — not as a technical document that has to be hastily translated afterward.
How we run it
- 01
Activation and triage
We establish what we know, what we do not, and what must not be touched yet.
- 02
Containment
Stopping forward progress without needlessly alerting the adversary or destroying evidence. Powering off the compromised server is almost never the right first move.
- 03
Investigation and scoping
Forensic analysis across affected systems to answer the question your board will ask: how far did they get and what did they take?
- 04
Eradication
Removal of all persistence. A poorly eradicated incident reopens within weeks, usually with more damage.
- 05
Recovery and closure
Phased return to operation with heightened monitoring, and a report that serves both the technical team and the insurance claim process.
What you receive
- Initial containment and a stop to the adversary's forward progress
- Determination of real scope — what was compromised and what was not
- Verified eradication and a phased recovery plan
- Root cause report suitable for your insurer, your regulator, and your board
- Lessons learned converted into concrete controls and detections