Reactive engagement / 05
Incident Response.
Where the hard cases land. Reconstruct what happened even when the evidence is cold, then contain, eradicate and recover.
During an incident the questions are simple and the answers are not. What got in, how far did it go, what did it take, and is it still here. Answering them takes evidence, and evidence degrades from the moment the incident starts.
When another team has already closed a case, this is often the second call, and the one that resolves it.
We take incident response engagements from Switzerland, across Europe and the Gulf, and the first call is with the person who will do the work.
Both routes reach the same team in Zug and the same standard of work. The difference is how much has to be negotiated on the day something happens.
Emergency incident response, for when something is happening now. Rapid deployment, containment, forensic analysis and guided recovery for ransomware, insider activity, data breach and targeted intrusion. If something is happening now, call rather than write.
Secures priority access to incident response before you need it, with the environment already understood and the communication protocols agreed in advance. Retainer hours not consumed by incidents are not lost. They convert to other consulting work.
What the work covers
Containment and evidence preservation pull against each other. Deciding that trade-off correctly, under time pressure, is most of the job.
01
One person accountable for the whole response, with the authority to gate it. Workstreams run in parallel, decisions are logged, and the executive briefing comes from a single voice.
Large incidents fail on coordination more often than on technique. Where several teams and vendors are on site, the work is keeping investigation, recovery, monitoring and hardening from pulling against each other, and holding the gate that stops a system being restored before it has been cleared.
02
Immediate action to stop the incident spreading: isolating affected systems, disabling compromised accounts and applying emergency measures.
The order matters. Pulling a machine off the network destroys volatile evidence that may be the only record of how the attacker got in, so containment steps are sequenced against what still needs to be captured.
03
Disk, memory and cloud evidence collected and analyzed to establish root cause, attack vectors and the true extent of the compromise, then assembled into one sequence of events across the estate.
A list of findings is not an account of an incident. Each step carries the artifact that supports it and a stated confidence level, including where the evidence is partial, degraded or was written off as unrecoverable. Evidence others consider unusable is regularly where the answer is found.
04
A remediation plan executed to eradicate the threat and return operations to a secure state, followed by a review that turns the incident into improvement.
Recovery without eradication returns you to the same position with less evidence. The route that was used is closed before systems come back, and the review says what to change so it stays closed.
How an engagement runs
Read it left to right: two steps in sequence, four streams in parallel, a coordinated eviction, then the review. The clock above them is the evidence, and it starts running before we do.
On notification the response activates and a rapid triage establishes the scope and severity of the incident.
Effort goes where it changes the outcome.
Stop the bleeding. Enough action to halt active damage, balanced against the evidence the investigation still depends on.
Where damage is already running, speed wins. Where an actor has been quiet for months, it does not, and containment waits.
Enhanced threat detection. Hardening of the environment. Forensic analysis. Coordination of initial recovery.
They are not independent tracks. Analysis produces the indicators detection hunts on, detection proves whether hardening held, and neither lets recovery restore a system that is not clean.
The eviction is held back until the four streams have made it safe, then executed as one coordinated action across the estate.
Taken piecemeal it tells the actor what you know and lets them re-enter through the access you have not found yet.
Once the incident is resolved, a review establishes what happened, how the response performed, and what to change so the same path is closed.
What you receive
Every conclusion states what was observed, what it supports, and how confident we are in it. Where the evidence does not settle a question, that is written down.
Anonymized case
Client, country, sector detail, dates and attribution are removed. The mechanism, the sequence and the decisions are unchanged.
CASE 01
INCIDENT COMMAND
DESTRUCTIVE ATTACK, STATE-LINKED ACTOR
NIST SP 800-61R3 / ICS-214 / ISO 27035
A government authority in the Middle East, operator of critical public infrastructure, lost its public-facing services overnight. Wiper malware had been pushed to every domain-joined system through a weaponised Group Policy object. More than fifteen servers were destroyed and over a thousand endpoints were targeted. Hours before the wiper ran, the primary backup appliance had been logged into from a compromised jump server and wiped, so that recovery would fail even if the malware was caught.
Three organizations were already on site. One owned the forensic investigation, one owned recovery, the internal SOC owned monitoring, and none of them were on a shared call. Recovery had begun restoring systems that had never been imaged. The investigation could not confirm the attacker was evicted, and the business could not wait for it to. I was brought in as Incident Commander to make the response work under that uncertainty instead of pausing for it.
Four workstreams, one command. A forensic clearance gate between investigation and recovery, so nothing was restored or rebuilt before imaging on that system was confirmed, and nothing returned to production without EDR reporting to the SOC. Every hardening measure paired with a detection use case, so an attempt to work around a control that had just been closed would surface instead of passing silently. When the intrusion turned out to be an eighteen-month campaign with multiple independent backdoors, the recovery sequence changed repeatedly, and the command structure is what let it change without the response coming apart.
Communications ran on the same discipline. One daily executive briefing, one voice to the board, the regulator and legal counsel, and no technical team speaking to any of them directly. Regulatory notification was carried as a formal decision with a legal clock running against it. Every line of that briefing was marked confirmed, assessed or unknown, and the unknowns stayed visible.
By day seventeen all twenty-eight applications in the two highest-priority tiers were restored, public-facing services among them.
Who this is for
What we need to scope a program
The method, in the open
