Incident Response
When it hits, we're already there.
Incident response is what separates a security program that tells a board-ready story from one that ends up on the SEC's 8-K disclosure list. This page documents our IR program: the NIST SP 800-61 lifecycle we run to, the pre-authorized containment that compresses response time to minutes, and the on-site guarantee that matters when the incident is real.
The six-phase IR lifecycle
Every incident we handle runs through the phased lifecycle documented in NIST SP 800-61 Computer Security Incident Handling Guide. This isn't academic. Every phase has its own success criteria, its own typical failure modes, and its own handoff to the next phase. The phases below map directly to the playbooks we execute in production.
Preparation
The work done before an incident determines what happens during one. Runbooks written, roles assigned, communication channels tested, IR retainers in place, tabletop exercises on a cadence, evidence preservation procedures documented. If preparation is weak, every other phase degrades.
Detection & Analysis
Detection identifies the incident. Analysis scopes it. The faster both happen, the smaller the blast radius. This is where MTTD matters: under 5 minutes is the SLA we run to, because attackers kick off lateral movement within 10-30 minutes of initial access and encryption payloads fire within 60-120 minutes on most ransomware campaigns.
Containment
Containment limits further damage. Isolate affected hosts, disable compromised accounts, revoke tokens, sever lateral movement paths. Pre-authorized containment makes this fast (MTTC under 15 minutes on our operation). Manual-approval containment is the reason so many ransomware events fully encrypt before anyone can stop them.
Eradication
Eradication removes the adversary's access. Compromised credentials rotated, persistence mechanisms removed, backdoors identified and closed, vulnerabilities exploited in the attack patched. Skipping eradication is why organizations get re-compromised within 30 days of 'resolving' an incident.
Recovery
Recovery restores business operations. Systems rebuilt or restored from known-clean backups, data integrity verified, phased return to production with monitoring for reinfection. Recovery has to happen on a timeline the business can tolerate, which is why the preparation phase matters so much.
Post-Incident Review
Lessons learned, root cause documented, detection gaps identified, runbooks updated, controls strengthened. The industry term is 'post-incident review' rather than 'post-mortem' because the patient lived. This is the phase most organizations skip, and it's the one that prevents the next incident.
Pre-authorized containment: the 15-minute rule
The single biggest operational lever on incident outcomes is pre-authorized containment. The typical MSSP approval flow (alert fires, analyst reviews, ticket to client, client approves, action executes) takes 45-90 minutes in the 2 AM reality. Ransomware runtime from initial access to full encryption on mid-market estates is typically 60-120 minutes. The math doesn't work.
We pre-authorize containment actions at contract signing within an agreed scope. EDR host isolation, privileged account disable, token revocation, network segmentation enforcement, and specific other actions execute without approval when detection conditions match. The client signs the runbook once, we execute on detection. Median MTTC on our operation is under 15 minutes, because the approval loop isn't there. The client retains the ability to revoke pre-authorization at any time. For actions outside pre-authorized scope, explicit approval still happens.
Playbooks for the scenarios that actually happen
Most IR programs have generic playbooks that don't match what incidents look like in practice. We maintain scenario-specific playbooks for the incident types that drive most of our actual response volume, with the steps, decisions, and evidence requirements documented for each.
Ransomware
What happens: The initial foothold arrives via phishing, exposed remote service, or supply-chain compromise. Lateral movement over hours or days. Mass encryption fires. Ransom note appears. Backups may be targeted before encryption starts.
Our playbook: Host isolation on first detection. Privileged accounts disabled. Network segmentation enforced to stop lateral spread. Forensic imaging of the first-detected hosts. Backup integrity verification. Recovery from clean backup images. Breach notification and regulator coordination as required.
Business Email Compromise (BEC)
What happens: Credential theft via phishing, then the attacker operates as the user: reads email, pivots to financial systems, sends fraudulent wire instructions, and often creates mail forwarding rules to persist.
Our playbook: Account disable. Session token revocation. Mail rule audit and cleanup. Financial system access review. Connected SaaS session revocation. Wire transfer holds with finance team. Documentation for SAR filing and potential insurance claim.
Insider threat
What happens: Current or former employee exfiltrating data, planting logic bombs, or providing access to external attackers. Detection is hard because the access is legitimate and the actions often happen within normal working patterns.
Our playbook: Legal and HR coordination before any technical action. Evidence preservation under chain-of-custody. Coordinated revocation of access across all systems. Forensic analysis of data movement. Documentation for employment-law proceedings or law enforcement referral.
Supply-chain compromise
What happens: A trusted software, service, or managed provider is compromised, and the adversary uses that trust relationship to reach your environment. Examples: SolarWinds-class, Kaseya-class, or MSP/MSSP-targeted attacks.
Our playbook: Scope investigation across all integrations with the compromised party. Access revocation and credential rotation for all tokens tied to the upstream relationship. Detection content tuning for the specific TTPs the adversary is using. Coordination with the upstream vendor and, where applicable, CISA reporting.
Forensic preservation and chain of custody
Every incident produces evidence. Whether that evidence holds up in regulatory proceedings, litigation, or insurance negotiations depends on how it was preserved. We preserve memory, disk images, and log extractions under documented chain of custody from the moment an incident is declared. Forensic-grade acquisition uses write-blockers on physical drives, volatility frameworks for memory analysis, and hash verification at every handoff. Evidence that can't survive an adversarial legal challenge isn't useful evidence.
The technical practice aligns with ISO/IEC 27037 (identification, collection, acquisition, and preservation of digital evidence) and NIST CFTT tool validation for the acquisition tools used. Our forensic analysts hold GCFA, GCFE, EnCE, and CCE credentials.
Breach notification and regulator coordination
Breach notification is the part of IR that ends up in lawsuits when it's done wrong. The regulatory landscape is now dense: HIPAA breach notification rule for healthcare, state AG notification under 50-plus state breach laws, SEC 8-K material cybersecurity incident disclosure for public companies, GDPR 72-hour notification for EU data subjects, industry-specific regulator rules (FFIEC for banks, NYDFS Part 500 for NY-regulated financial institutions, FTC Safeguards for financial services), and increasingly sector-specific obligations under CISA's critical infrastructure framework.
We maintain the notification playbook as a live document per client, mapping which incident types trigger which notifications, on what timelines, to which authorities, with what content requirements. When an incident is declared, the notification decisions surface in the first 24 hours with documentation ready for breach counsel review. The CISA incident response guidance and the FBI IC3 reporting portal are part of the standard flow when law enforcement referral is appropriate.
IR retainer structure
An IR retainer converts incident response from a crisis procurement exercise into a ready capability. Retainer clients get guaranteed response SLAs, on-site support within 24 hours, pre-authorized containment, and the integration with MDR and SIEM operations that lets us engage within minutes rather than hours. The retainer fee covers guaranteed availability; actual incident-hour billing happens at a pre-agreed rate on the rare occasion a retainer client hits an incident.
Retainer hours not consumed by incidents roll over quarterly into tabletop exercises, playbook updates, detection engineering contributions, and the tabletop-to-production feedback loop that makes the response program stronger over time. Clients who engage us on an IR-only basis without an existing MDR relationship typically add MDR within the first year, because the preparation-through-recovery cycle works substantially better when the same team that responds also operates the detection layer.
How this integrates with the rest of the security program
Incident response doesn't live in isolation. It connects to detection (via our managed detection and response and SOC as a service practices), to detection engineering (our managed SIEM team tunes rules against lessons learned from incidents), to executive security leadership (our vCISO service handles board-level communications during and after material incidents), and to strategic architecture (our Zero Trust implementation reduces the attack surface that generates incidents in the first place).
The practical benefit of running all of these under one contract is that incidents don't get stuck in handoffs between vendors at 3 AM. One team owns detection, containment, forensics, leadership communication, and the post-incident control strengthening. For the case-study view of how this plays out in regulated environments, see the financial services SOC 2 case study and the healthcare HIPAA migration case study.
Related reading
- Ransomware response playbook (blog) — hour-by-hour through the first 24 hours of a ransomware incident.
- Top cybersecurity threats 2026 — the threat landscape that drives incident volume.
- Zero Trust architecture — the prevention layer that reduces incident frequency.
- Managed Detection and Response — the detection layer that feeds incident response.
Frequently asked questions
What does an IR retainer actually cover?
Our IR retainer covers guaranteed response SLAs, pre-authorized containment, on-site support within 24 hours of a qualifying incident, forensic preservation and analysis, breach notification support, regulator coordination, and integration with your cyber insurance carrier. Retainer hours roll over quarterly for tabletop exercises, playbook updates, and detection engineering work.
How fast can you engage on an incident?
For active EFROS MDR clients, detection through containment runs under 15 minutes on pre-authorized actions. For IR-retainer-only clients, we engage within 30 minutes of notification during business hours and 60 minutes outside of business hours. On-site analysts can be at client facilities within 24 hours for any incident within the continental US.
What frameworks do you align to?
NIST SP 800-61 Computer Security Incident Handling Guide is the primary reference for lifecycle. CISA's Cybersecurity Incident & Vulnerability Response Playbooks for federal alignment. The SANS Incident Response methodology for operational cadence. MITRE ATT&CK for adversary behavior mapping. All of these inform how we structure playbooks and evidence collection.
Do you support cyber insurance coordination?
Yes. We work with every major cyber insurance carrier and know which panel firms they prefer to engage. If you have insurance with a specific firm as named IR, we coordinate under their scope. If the carrier doesn't have a hard preference, we can be engaged directly, and we'll produce the documentation they need for claim processing.
What's included in breach notification support?
Breach notification involves legal counsel, regulator notification (HHS for HIPAA, state AGs, EU DPAs for GDPR, specific industry regulators), customer notification, and in some cases law enforcement referral. We provide the technical documentation and evidence support for all of these streams, coordinate with your breach counsel, and can provide expert testimony if matters escalate to regulatory enforcement or litigation.
How do tabletop exercises work?
Quarterly or semi-annual exercises run against realistic scenarios aligned to your threat profile. Executive tabletops focus on business decisions, communications, and regulatory obligations. Technical tabletops focus on detection, containment, and recovery procedures. Both produce a written after-action report with documented improvement actions and owners.