Incident Response

Be ready before the incident happens.

We help security teams build an incident response capability they've rehearsed, with a plan people can follow under pressure and runbooks for the threats most likely to affect them. Then we test it, so you find the weak points during an exercise rather than during a real incident.

Discuss your incident readiness

The problem

Most incident response plans describe stages and processes, but they don't answer the questions that matter under pressure: who can take a system offline at 2am, when legal needs to be involved, or how ransomware should be contained in your environment.

An audit-ready plan is a document. A working incident response plan is a capability.

This is for you if

You don't have an incident response plan, or it hasn't been tested.
You've been through an incident recently and want to be better prepared for the next one.
Nobody is sure who has the authority to make containment decisions.
Your plan is generic and doesn't cover the threats most relevant to you, such as ransomware or business email compromise.
Auditors, insurers or regulators are asking for evidence of incident readiness.

What we do

We build incident response capability around your environment, your people and the threats you're most likely to face.

Review your current plan, escalation paths, roles and decision authority.
Write or rework your Cyber Security Incident Response Plan (CSIRP) so it reflects how your organisation operates.
Build threat-specific runbooks for scenarios such as ransomware, business email compromise and data exfiltration.
Align response processes with your SOC and security tooling, so analysts know what to do when an incident starts.
Run technical tabletop exercises with your security and IT teams to test detection, investigation and containment against realistic scenarios.
Run leadership tabletop exercises to test how incidents are escalated to senior management, who approves key decisions such as taking systems offline or bringing in external support, and how those approvals are obtained under pressure.
Train SOC analysts to triage, escalate and respond consistently.
Run post-incident reviews that lead to specific improvements in detection, process and tooling.

What you get

An incident response plan your team can follow under pressure.
Threat-specific runbooks built around your environment.
Clear roles, escalation paths and decision authority.
A team that has tested its response before a real incident.

Results

20+threat-specific incident response runbooks deliveredFollowing a significant incident, we built a company-wide CSIRP, addressed audit findings and trained SOC staff to improve triage and escalation.Read the case study

A good place to start

Want to know how ready you are?

Incident Readiness Review

typically 2-4 weeks

We review your incident response plan, escalation paths, roles and responsibilities, tooling and runbooks, then test them through a tabletop exercise based on a realistic threat to your organisation.

You get: a prioritised gap assessment, clear recommendations for improving your incident response capability, and an after-action report from the tabletop exercise.

Discuss an Incident Readiness Review

Recently had an incident?

We can review what happened, identify where response, detection or process broke down, and help prioritise the changes needed before the next incident.

Discuss a post-incident review

Platforms and technologies

We work with the security tooling already in your environment, including platforms such as Splunk, Microsoft Defender XDR, Microsoft Sentinel, Carbon Black Response, Darktrace, Proofpoint and SOAR platforms. Plans and runbooks are built around how your organisation detects, investigates and responds to incidents.

Frequently Asked Questions

What is a CSIRP?

A Cyber Security Incident Response Plan (CSIRP) sets out how your organisation detects, escalates, contains and recovers from a cyber incident. A useful one names who makes which decisions, how the team communicates if normal channels are down, and when to involve legal, insurers and regulators. It is usually backed by runbooks that cover specific threats in more detail.

What is a tabletop exercise?

A tabletop exercise walks your team through a realistic incident scenario as a discussion, without touching live systems. We usually start with a technical exercise for the security and IT teams, then run a second with senior leadership focused on escalation, approvals and decision-making. Each one shows where the plan is unclear or depends on one person, and ends with an after-action report and a list of improvements.

Can you help after an incident?

Yes. We can review how the incident was detected and handled, identify gaps in escalation, containment, tooling and process, and turn the findings into prioritised improvements. That can include updating response plans and runbooks, improving detections and running a follow-up exercise to test the changes.

Tell us what you're working on.

Whether it's a noisy SOC, detections you don't trust, an untested response plan or a security project that needs delivering, a short call is the quickest way to work out what to do next.

Talk to a security specialist

Free 30-minute call · No obligation · Speak directly with the person who'd do the work