Our retainer removes procurement and onboarding delays during a security incident. Before a crisis, we learn your environment, align decision-makers and test the response process. During an event, a senior lead coordinates containment, investigation, evidence and recovery.
We begin with the outcomes your organisation must protect, then examine the people, processes, technology and dependencies that support them. This creates a practical programme grounded in operating reality rather than a generic framework exercise.
Where we focus first
Turn complex exposure into clear decisions
Pre-incident environment and stakeholder onboarding
We establish current exposure, ownership and the next defensible action.
Emergency triage and incident command
We establish current exposure, ownership and the next defensible action.
Endpoint, cloud, identity and email forensics
We establish current exposure, ownership and the next defensible action.
What we cover
Expertise built around your risk
Each workstream combines evidence review, stakeholder context and practical validation. You receive a complete view of current effectiveness, priority gaps and the sequence required to improve.
We assess pre-incident environment and stakeholder onboarding against your operating environment, threat exposure and obligations, then translate the findings into sequenced improvements with named owners and measurable evidence.
We assess emergency triage and incident command against your operating environment, threat exposure and obligations, then translate the findings into sequenced improvements with named owners and measurable evidence.
We assess endpoint, cloud, identity and email forensics against your operating environment, threat exposure and obligations, then translate the findings into sequenced improvements with named owners and measurable evidence.
We assess ransomware and business-email-compromise response against your operating environment, threat exposure and obligations, then translate the findings into sequenced improvements with named owners and measurable evidence.
We assess evidence preservation and timeline reconstruction against your operating environment, threat exposure and obligations, then translate the findings into sequenced improvements with named owners and measurable evidence.
We assess legal, insurer and communications coordination support against your operating environment, threat exposure and obligations, then translate the findings into sequenced improvements with named owners and measurable evidence.
How we deliver
A clear path from risk to control
Prepare
Agree scope, contacts, access, legal considerations and containment authority.
Decisions, owners and evidence are documented before the next stage begins.
Respond
Mobilise the right specialists to contain, investigate and brief stakeholders.
Decisions, owners and evidence are documented before the next stage begins.
Recover
Support safe restoration, close root causes and improve the response plan.
Decisions, owners and evidence are documented before the next stage begins.
What you receive
Clear evidence, not just advice
Engagement deliverables
- Retainer onboarding and readiness review
- Escalation matrix and emergency runbook
- Allocated response hours and priority access
- Incident findings and forensic timeline
- Recovery and lessons-learned report
Best suited for
- Organisations where downtime has high impact
- Regulated teams with notification obligations
- Businesses without a complete internal forensic capability
What changes
Practical business outcomes
- Faster mobilisation and containment
- Clear roles during high-pressure events
- Reliable evidence for decisions and reporting
- Reduced recovery time and repeat risk
How success is measured
Measures are agreed at the outset and tracked through delivery. Leadership receives a concise view of risk reduction, control adoption, evidence quality, accountable closure and any residual decisions requiring support.