Focused work for incidents, assurance and recovery.

When to engage

Systems are encrypted or unavailable, privileged accounts appear compromised, critical services are disrupted, or the extent of an incident remains unclear.

What we assess

Affected assets, identity activity, available logs, current attacker access, containment options, recovery sources and operational dependencies.

How it works

We establish an incident structure, confirm priorities, preserve relevant evidence, support containment and coordinate investigation with recovery.

What you receive

• Incident action plan
• Situation updates
• Evidence register
• Recovery criteria
• Technical and executive reports

When to engage

You need to verify compromise, understand how suspicious activity developed or validate whether remediation addressed the observed activity.

What we assess

Windows artifacts, endpoint telemetry, server logs, Microsoft 365 audit data, Active Directory records, authentication events and suspicious files.

How it works

We define the questions, identify and preserve evidence, correlate events and distinguish direct observations from analytical assessments.

What you receive

• Evidence index
• Forensic timeline
• System findings
• Confidence statements
• Executive summary

When to engage

Before a major change, after material remediation, following an incident or when leadership needs a practical view of current exposure.

What we assess

Internet-facing systems, internal networks, Microsoft 365, Active Directory, firewall architecture, cloud infrastructure, backup controls and readiness.

How it works

Scope and rules of engagement are agreed first. Automated discovery is combined with manual validation and controlled exploitation.

What you receive

• Validated findings
• Supporting evidence
• Severity rationale
• Remediation roadmap
• Retest statement when agreed

When to engage

New infrastructure is being introduced, recurring findings require structural change or security must be standardized across locations.

What we assess

Trust boundaries, privileged access, identity controls, segmentation, remote administration, Microsoft 365, logging and operational dependencies.

How it works

Current-state controls are compared with the threat model and operating requirements, then target changes are reviewed with system owners.

What you receive

• Architecture review
• Target-state design
• Hardening baselines
• Logging requirements
• Implementation priorities

When to engage

Recovery plans have not been tested, backup success has not been independently validated or systems are returning after an incident.

What we assess

Backup integrity, administrative separation, recovery dependencies, Active Directory recovery, clean-build processes and reconnect criteria.

How it works

Critical dependencies are mapped, assumptions are tested and selected restore procedures are validated under agreed conditions.

What you receive

• Dependency map
• Validation records
• Recovery sequence
• Identity recovery actions
• Acceptance criteria

When to engage

Technical findings must support leadership decisions, legal review, risk ownership, investment planning or stakeholder communication.

What we assess

The decisions required, evidence supporting them, material dependencies and relevant reporting on observed techniques, tools, indicators and sector exposure.

How it works

External threat intelligence is assessed for relevance and kept distinct from evidence confirmed in the client environment. Technical work is then translated for decision-makers with confidence and limitations intact.

What you receive

• Executive briefings
• Board-ready summaries
• Technical reports
• Decision logs
• Risk treatment options