Reactive engagement / 05
Where the hard cases land. Reconstruct what happened even when the evidence is cold, then contain, eradicate and recover.
During an incident the questions are simple and the answers are not. What got in, how far did it go, what did it take, and is it still here. Answering them takes evidence, and evidence degrades from the moment the incident starts.
When another team has already closed a case, this is often the second call, and the one that resolves it.
Incident response engagements are taken from Switzerland, across Europe and the Gulf, and the first call is with the person who will do the work.
Emergency response and the retainer are both available directly. The difference on the day is everything in the table below.
Emergency incident response, for when something is happening now. Rapid deployment, containment, forensic analysis and guided recovery for ransomware, insider activity, data breach and targeted intrusion. If something is happening now, call rather than write.
Secures priority access to incident response before you need it, with the environment already understood and the communication protocols agreed in advance. Retainer hours not consumed by incidents are not lost. They convert to other consulting work.
Both routes on offer reach the same people in Zug and the same method. What differs is everything that happens before the call, and the first hours of an incident are where that difference is paid back or paid for. The middle column is here because it is the arrangement most often mistaken for one of the other two.
| Emergency IRcalled on the day | Cyber insurancefor comparison only | DFIR Retaineragreed before anything happens | |
|---|---|---|---|
| Availability on the day | Subject to available capacity on the day. Loaded periods are real, and the end of the year is the worst of them. | Funded once the claim is opened, but the responder comes from a panel the insurer chooses, and that panel can change between renewals. | A response SLA, written into the contract, honoured by the team that already knows the environment. |
| The first hours | It starts with a call and an email: a long list of logs and data to be collected, then transferred, then processed and then analyzed. Some of the answers requested depend on people who may be at home, on leave, or already busy recovering. | The same, once a claim has been opened and a firm assigned. | It starts with analysis. Velociraptor is already deployed and the relevant evidence is already reachable, so the first hours are spent reading it rather than asking for it. |
| Progress 24 hours after kick-off | Daily updates start immediately, but the first is largely a list of what is still missing or blocking the investigation, and a few generic security best practices. Nothing has been established as clean yet, so recovery cannot safely start. | The same, and the clock starts only once the claim is opened and a firm is assigned, so hour 24 of the incident is not hour 24 of the investigation. | The first daily update already carries findings, and immediate containment and hardening steps to allow the recovery of critical business applications. Because collection already spans the estate, it can also say where the compromise is not, which is what makes a restart possible. |
| Knowing what normal looks like | Nothing is known in advance. The first days go on learning the estate, while the internal team is also trying to recover. | Whoever turns up has never seen the estate. What would look wrong to someone who knows it goes past unnoticed. | Onboarding maps the account naming conventions, the network, and where the crown jewels sit, resynchronised every three months. What looks wrong is recognized as wrong. |
| What the investigation can answer | Whatever the logs that happen to exist allow. In practice they rarely cover every question the investigation needs to ask, and some end with no answer at all. | The same. A policy funds the investigation. It does not change what evidence exists to investigate. | The log sources and audit settings an investigation depends on are specified at the start, and checked if the first months stay quiet. The questions have answers because the evidence was made to exist. |
| Preventing incidents | Out of scope. There is no relationship before the call, and no view of the environment to improve. | Some policies include pre-breach services, but none of it is built around the firm that will actually turn up, because that firm is not known in advance. | Included. The environment is reviewed and what makes a large incident likely is fixed. It consumes hours on purpose: a large incident answered well is still a failure of prevention. |
| What the money buys | The emergency hour costs far more than the retainer hour. | A premium that pays out against loss. It is not hours that can be spent. | The standard rate, on hours agreed in advance. |
| If the year stays quiet | Nothing was spent, and nothing changed. | The premium is spent, which is what a premium is for. Nothing about readiness changed. | Hours not consumed by incidents are not lost. They go to the visibility review, the hardening backlog, or other consulting work chosen by the client. |
What the work covers
Containment and evidence preservation pull against each other. Deciding that trade-off correctly, under time pressure, is most of the job.
01
One person accountable for the whole response, with the authority to gate it. Workstreams run in parallel, decisions are logged, and the executive briefing comes from a single voice.
Large incidents fail on coordination more often than on technique. Where several teams and vendors are on site, the work is keeping investigation, recovery, monitoring and hardening from pulling against each other, and holding the gate that stops a system being restored before it has been cleared.
02
Immediate action to stop the incident spreading: isolating affected systems, disabling compromised accounts and applying emergency measures.
The order matters. Pulling a machine off the network destroys volatile evidence that may be the only record of how the attacker got in, so containment steps are sequenced against what still needs to be captured.
03
Disk, memory and cloud evidence collected and analyzed to establish root cause, attack vectors and the true extent of the compromise, then assembled into one sequence of events across the estate.
A list of findings is not an account of an incident. Each step carries the artifact that supports it and a stated confidence level, including where the evidence is partial, degraded or was written off as unrecoverable. Evidence others consider unusable is regularly where the answer is found.
04
A remediation plan executed to eradicate the threat and return operations to a secure state, followed by a review that turns the incident into improvement.
Recovery without eradication returns you to the same position with less evidence. The route that was used is closed before systems come back, and the review says what to change so it stays closed.
How an engagement runs
Read it left to right: two steps in sequence, four streams in parallel, a coordinated eviction, then the review. The clock above them is the evidence, and it starts running before the response does.
On notification the response activates and a rapid triage establishes the scope and severity of the incident.
Effort goes where it changes the outcome.
Stop the bleeding. Enough action to halt active damage, balanced against the evidence the investigation still depends on.
Where damage is already running, speed wins. Where an actor has been quiet for months, it does not, and containment waits.
Enhanced threat detection. Hardening of the environment. Forensic analysis. Coordination of initial recovery.
They are not independent tracks. Analysis produces the indicators detection hunts on, detection proves whether hardening held, and neither lets recovery restore a system that is not clean.
The eviction is held back until the four streams have made it safe, then executed as one coordinated action across the estate.
Taken piecemeal it tells the actor what you know and lets them re-enter through the access you have not found yet.
Once the incident is resolved, a review establishes what happened, how the response performed, and what to change so the same path is closed.
What you receive
Every conclusion states what was observed, what it supports, and the confidence attached to it. Where the evidence does not settle a question, that is written down.
Anonymized case
Client, country, sector detail, dates and attribution are removed. The mechanism, the sequence and the decisions are unchanged.
CASE 01
INCIDENT COMMAND
DESTRUCTIVE ATTACK, STATE-LINKED ACTOR
NIST SP 800-61R3 / ICS-214 / ISO 27035
A government authority in the Middle East, operator of critical public infrastructure, lost its public-facing services overnight. Wiper malware had been pushed to every domain-joined system through a weaponised Group Policy object. More than fifteen servers were destroyed and over a thousand endpoints were targeted. Hours before the wiper ran, the primary backup appliance had been logged into from a compromised jump server and wiped, so that recovery would fail even if the malware was caught.
Three organizations were already on site. One owned the forensic investigation, one owned recovery, the internal SOC owned monitoring, and none of them were on a shared call. Recovery had begun restoring systems that had never been imaged. The investigation could not confirm the attacker was evicted, and the business could not wait for it to. I was brought in as Incident Commander to make the response work under that uncertainty instead of pausing for it.
Four workstreams, one command. A forensic clearance gate between investigation and recovery, so nothing was restored or rebuilt before imaging on that system was confirmed, and nothing returned to production without EDR reporting to the SOC. Every hardening measure paired with a detection use case, so an attempt to work around a control that had just been closed would surface instead of passing silently. When the intrusion turned out to be an eighteen-month campaign with multiple independent backdoors, the recovery sequence changed repeatedly, and the command structure is what let it change without the response coming apart.
Communications ran on the same discipline. One daily executive briefing, one voice to the board, the regulator and legal counsel, and no technical team speaking to any of them directly. Regulatory notification was carried as a formal decision with a legal clock running against it. Every line of that briefing was marked confirmed, assessed or unknown, and the unknowns stayed visible.
By day seventeen all twenty-eight applications in the two highest-priority tiers were restored, public-facing services among them.
Who this is for
What is needed to scope a program
The method, in the open
