01 · Cybersecurity and Infrastructure
Incident Response and Digital Forensics
A team on call for the day it happens - and the evidence to explain it afterwards.
Cybersecurity and Infrastructure
Incident Response and Digital Forensics
A team on call for the day it happens - and the evidence to explain it afterwards.
Showing 1 of 10
- 1Retainer in place
- 2Triage the incident
- 3Contain and eradicate
- 4Investigate
- 5Report and harden
What We Do for You
- Hold a retainer so help starts within agreed hours, not after procurement.
- Take charge of containment, eradication and recovery with your team.
- Preserve evidence properly from the first hour.
- Reconstruct what happened and how far it reached.
- Deliver the report your board, insurer or regulator will ask for.
How this is bought: Bought as a monthly managed service on a rolling term, with a written service schedule. Build an estimate for your case.
Response times apply to clients holding a signed retainer. Without a retainer we respond on a best-efforts basis, subject to team availability.
Platforms We Work With
Check PointCisco
These are the platforms we work with on client estates. Where a client already owns a different platform, we work with theirs - ARRIX is not tied to any one vendor.
Our Approaches Explained
Response retainer
Terms and contacts agreed in advance so the clock starts at the incident, not at the contract.
Containment and eradication
Stopping the spread, removing the foothold, and confirming it is gone.
Forensic evidence handling
Images, logs and chain of custody kept so findings stand up to challenge.
Root cause and scope reconstruction
What entered, when, how far it reached and what left.
Regulator, insurer and customer reporting
The written account each party requires, within their deadline.
The Standards We Work To
NIST SP 800-61 incident handlingNIST SP 800-86 forensicsBreach notification regimes by jurisdiction
We follow the structure and controls these standards describe. We do not claim to be certified against them - where you need a formal certificate, we prepare the evidence and an accredited body performs the audit.
What You Get
- Retainer and contact tree
- Containment and recovery actions
- Forensic evidence pack
- Root cause report
- Regulatory and insurer statements
Retainer clients reached inside agreed time98%
Incidents with preserved evidence100%
Post-incident hardening delivered95%
These are the areas clients most often ask us to improve. Your project sets its own targets, measured and agreed with you.
Before You Sign
Response work begins from a signed engagement letter that sets scope, our authority to act, evidence handling, confidentiality, liability limits and insurance. Nothing in these pages is a promise of prevention or of a particular outcome; cyber incidents are adversarial and results depend on facts outside anyone’s control. Where a cyber insurer is involved, we work to the terms of your policy and coordinate with your appointed counsel.