Talk to an architect

Managed Security

When an incident happens, a plan and a team are already in place.

Incident response retainers, containment and forensic investigation, recovery support, and tabletop exercises that rehearse the decisions in advance.

Talk to an architect What is included

Sound familiar

Where this usually starts.

The first hours of an incident decide how much it costs. Organizations that have agreed who decides, who is told, which systems are isolated and which regulators must be notified recover faster and pay less. We prepare that in advance with plans and exercises, and when an incident happens we respond: containment, investigation, eradication and recovery, with evidence preserved for insurers, regulators and courts.

Tick the ones that sound like your situation.

Scope

What is included.

  • Response retainer

    Pre-agreed access to responders, with terms settled before they are needed.

  • Containment

    Affected systems and accounts isolated to stop the spread.

  • Investigation

    Forensic analysis of how the attacker got in and what they reached.

  • Recovery

    A clean rebuild and restoration, monitored for any return.

  • Notification support

    Evidence and timelines for regulators, insurers and affected parties.

  • Tabletop exercises

    Leadership and technical teams rehearse decisions in a realistic scenario.

Reference architecture

From every signal to one response, and the evidence for the audit.

Incident response is the far end of the security architecture's respond layer: when containment is not enough, responders investigate, eradicate and recover, and feed what they learn back into detection.

From every signal to one response, and the evidence for the audit. TELEMETRY DETECT RESPOND GOVERN Email Endpoints Identity Cloud SIEM EDR and XDR Vulnerabilityscanning SOC analysts Containment Incident response Controls andevidence Risk reporting

What this service delivers here

  • Containment

    Isolate the device, revoke the session, block the sender.

  • Incident response

    When it is serious: investigation, recovery and the report afterwards.

Walk through every flow in Managed Security

Before you start

Decisions to settle early.

  • Retainer or call when needed

    Without a retainer, contracting happens during the incident; with one, responders start at once. Insurance terms often decide.

  • Who leads the response

    Your leadership makes business decisions; responders lead the technical work. The plan says who does what.

  • When to involve law enforcement

    Reporting can help and may be required, but it has consequences. Counsel decides, with the facts we establish.

Approach

How the work runs.

  1. Prepare

    Plans, contacts and decision rights

  2. Contain

    Stop the spread and preserve evidence

  3. Investigate

    Root cause and scope of impact

  4. Recover

    Rebuild, restore and harden

Commercials

How it is bought.

  • A fixed-fee assessment

    Preparation starts with a review of your plan, contacts, insurance terms and notification duties, often with a tabletop exercise. You receive the gaps and a fixed price for preparation or a retainer.

  • A fixed-price build

    Plan writing, playbooks and exercises are priced as a fixed program. An active incident is handled under the retainer's agreed terms.

  • Running it afterwards

    A retainer keeps responders on call with terms settled in advance, and unused time goes to preparation such as exercises and plan reviews.

Start with the assessment.

Scope an assessment

Worked example

Ransomware on a Saturday morning.

Say a distribution company finds files encrypted on its file servers early on a weekend. It has an incident response plan, written last year and never rehearsed, and its insurer must be told before a responder is engaged.

  1. Mobilize

    The insurer is notified under the policy, our responders are engaged, and the decision makers named in the plan are brought together on one call.

  2. Contain

    Affected servers and the accounts the attacker used are isolated, with memory and disk images preserved before anything is wiped.

  3. Investigate

    Forensic analysis traces the entry point to a compromised remote access account and establishes which data was reached.

  4. Recover

    Systems are rebuilt from clean backups, the entry point is closed, monitoring watches for a return, and the evidence pack supports the notifications.

At the end, the company has recovered, knows how the attacker got in and what they reached, and has met its notification duties with evidence rather than estimates.

An illustration

An illustration, not a client account.

Where it goes wrong

What we design out.

  • A plan never rehearsed

    Plans that have not been exercised fail at the first decision. Tabletop exercises test who decides before it matters.

  • Cleaning instead of rebuilding

    Removing what is found leaves what is not. Compromised systems are rebuilt from a trusted state.

  • Evidence lost in the rush

    Wiping systems quickly destroys what insurers and regulators need. Evidence is preserved before recovery begins.

Outcomes

What it changes.

  • Faster containment

    Decisions rehearsed in advance are made in minutes during a real incident.

  • Deadlines met

    Notification duties are known in advance, with evidence ready when regulators ask.

  • A clean recovery

    Systems are rebuilt from a trusted state, so the attacker does not come back.

How you will know it is working

  • Leadership knows who decides in an incident, and has practised it.
  • Notification deadlines are listed in the plan before they are needed.
  • Recovered systems stay clean afterwards.
  • Your insurer's requirements are met in advance.

You keep

What you have at the end.

Handover pack

five items

  1. Incident response plan and playbooks Who decides, who is told and what is done in each kind of incident, written for your organization and its regulators.
  2. Tabletop exercise report What the exercise showed about your plan, contacts and decision rights, and what to change.
  3. Incident timeline and forensic findings How the attacker got in, what they did and reached, and the evidence behind each finding.
  4. Recovery and hardening plan How systems are rebuilt from a trusted state, and the changes that stop the same attack working again.
  5. Notification evidence pack The facts, timelines and decisions regulators, insurers and affected parties need, assembled as the incident runs.

The team

Who you work with.

  • Incident lead

    Runs the technical response, coordinates with your leadership and keeps the timeline.

  • Forensic analyst

    Preserves evidence, traces the attack and establishes what was reached.

  • Recovery engineer

    Rebuilds systems from a trusted state and closes the entry point.

What we need from you

  • Your incident response plan and contact lists, if they exist.
  • Your cyber insurance policy terms.
  • Access to logs, backups and security tools.
  • Decision makers available for exercises, and in a real incident.

Detect, contain, recover and learn, with the same engineers throughout.

Questions

Questions we get asked.

We think we are under attack now. What should we do?

Call the number in the contact section at the foot of this page, and write to solutions@expandware.com with the word incident in the subject. If you are already a client, use the route on the Client Support page, where the response targets in your agreement apply. Disconnect affected machines from the network rather than powering them off, unless they are actively encrypting data, because memory holds evidence.

What is a tabletop exercise?

A facilitated session in which leadership and technical staff work through a realistic incident scenario, decision by decision. It reveals gaps in the plan, the contact lists and the lines of authority without the cost of a real incident.

How quickly do we have to notify regulators?

It depends on the law and the sector. Under the GDPR it is 72 hours from becoming aware of a notifiable personal data breach; NIS2 requires an early warning within 24 hours of a significant incident; other regimes set their own clocks. The plan we write for you lists the deadlines that apply to you.

Will you work with our insurer?

Yes. Many policies name approved responders or require notification before one is engaged, so we check the policy terms as part of preparing the plan.

Should we pay a ransom?

That is a decision for your leadership, informed by legal advice, your insurer and the law where you operate; some payments are prohibited outright by sanctions rules. Our part is to establish the facts quickly: whether backups can restore the systems, what data was taken, and what paying would and would not change.

What does an incident response retainer include?

Terms, contacts and access agreed in advance, so responders can start without negotiating a contract during an incident. A retainer usually includes preparation as well, such as a plan review or a tabletop exercise, and time not used on incidents can go to that preparation.

How is evidence preserved during an incident?

Memory and disk images are captured from affected systems before they are cleaned, logs are copied out of systems an attacker could alter, and every item is recorded with when and by whom it was collected. That chain of custody is what lets the evidence stand up with insurers, regulators and courts.

How do we know the attacker is really gone?

By finding how they got in and every foothold they established, then rebuilding affected systems from a trusted state rather than cleaning them. Monitoring stays heightened after recovery, watching for the techniques and infrastructure the attacker used, so a return is noticed early.

Ask about your situation

Answered from this site, with its sources.

Where it is bought

Incident response, by sector and region.

Sectors that buy Managed Security

Region homes, and who signs

Often paired with

What usually comes next.

Everything in Managed Security

CONTACT

Rehearse the incident before it is real.

Start with a tabletop exercise and a review of your plan. You get a report of the gaps and the decisions to settle now.

  • Senior-led
  • Accountable
  • Direct
  • Fixed-price options
  • Compliance-ready
  • 24/7 capable

Prefer to talk it through? Call +92 (333) 32 11011

What happens next

  1. You pick the time

    If an incident is happening now, say so in the first line and call; otherwise choose any time for the call.

  2. Thirty minutes, with an engineer

    An incident responder discusses your plan, your insurance terms and your notification duties.

  3. A written assessment

    It sets out the gaps and a fixed price for preparation or a retainer.