Respond to cyber incidents quickly, preserve critical evidence and understand what happened

Emergency incident triage

Assess the situation, immediate risks and required containment actions.

Incident response mobilisation

Activate the agreed response team, communication channels and responsibilities.

Incident scoping

Identify affected users, systems, locations, applications and data.

Containment planning

Define safe actions to limit further attacker activity or data loss.

Short-term containment

Coordinate immediate actions such as account restriction, endpoint isolation or firewall blocking.

Long-term containment

Support safer temporary operating controls while remediation continues.

Eradication support

Assist with removing malicious tools, access paths, persistence and compromised credentials.

Recovery support

Guide secure restoration of systems, services and business operations.

Post-incident review

Document lessons learned, gaps and improvement actions.

Digital evidence preservation

Preserve relevant files, logs, images and system data.

Chain-of-custody documentation

Record evidence handling, transfer, access and storage.

Forensic imaging

Create controlled forensic copies of approved storage devices.

Disk forensics

Analyse file systems, deleted files, user activity and artefacts.

Memory forensics

Analyse selected volatile memory for processes, connections and malicious activity.

Endpoint forensics

Investigate Windows, Linux and selected endpoint devices.

Server forensics

Analyse selected physical, virtual and cloud-hosted servers.

Network forensics

Review selected traffic, firewall, IDS, VPN and proxy evidence.

Email forensics

Investigate messages, headers, forwarding, mailbox rules and suspicious activity.

Microsoft 365 forensics

Analyse selected Entra ID, Exchange Online, SharePoint and OneDrive evidence.

Azure forensics

Review selected sign-in, administrative, network and resource activity.

AWS forensics

Analyse selected CloudTrail, IAM, network and workload evidence.

Mobile device forensics

Support approved investigation of selected mobile devices and artefacts.

Cloud application forensics

Investigate activity within selected SaaS and hosted platforms.

Web server log analysis

Review selected access, error and application logs.

Database activity analysis

Review selected authentication, query and privilege evidence.

Active Directory investigation

Analyse account, group, authentication and policy activity.

Privileged account investigation

Review suspicious administrative and elevated activity.

User activity reconstruction

Reconstruct selected user actions across available evidence.

Timeline reconstruction

Develop a chronological view of relevant events.

Root-cause analysis

Identify the likely initial access point and contributing control failures.

Attack-path analysis

Map how an attacker moved across systems and accounts.

Persistence analysis

Identify mechanisms used to retain access.

Privilege escalation analysis

Determine how elevated access may have been obtained.

Lateral movement analysis

Determine how compromise spread between systems.

Command-and-control analysis

Review communications with suspected malicious infrastructure.

Data exfiltration analysis

Assess whether information may have been copied or transmitted externally.

Malware triage

Classify suspicious files and determine likely behaviour.

Malware analysis

Analyse selected malicious code, indicators and execution behaviour.

Ransomware investigation

Determine likely entry point, spread, impact and persistence.

Ransomware readiness review

Assess backup, segmentation, endpoint and response weaknesses after an event.

Business email compromise investigation

Investigate mailbox access, forwarding, impersonation and fraudulent activity.

Phishing incident investigation

Analyse malicious messages, links, attachments and affected users.

Credential theft investigation

Assess compromised passwords, tokens and authentication activity.

Account takeover investigation

Review suspicious logins, MFA changes and administrative actions.

Insider threat investigation

Analyse approved evidence relating to suspected internal misuse.

Unauthorised access investigation

Determine how access was obtained and what activity occurred.

Data breach investigation

Assess systems, records, exposure and possible information loss.

Website compromise investigation

Investigate malicious files, account misuse and web application activity.

Server compromise investigation

Analyse suspicious processes, accounts, services and network activity.

Cloud compromise investigation

Review selected identity, resource and configuration events.

Lost or stolen device investigation

Assess available evidence and possible data exposure.

Fraud investigation support

Analyse approved digital evidence linked to suspected fraud.

Invoice manipulation investigation

Review mailbox activity and communications associated with payment fraud.

Domain spoofing investigation

Assess lookalike domains, spoofed email and related abuse.

Log preservation

Secure relevant logs before retention periods or rotation remove evidence.

Security event correlation

Correlate evidence from multiple systems and sources.

Indicator-of-compromise extraction

Identify malicious domains, IP addresses, hashes, accounts and artefacts.

Threat intelligence enrichment

Use selected threat intelligence to add context to findings.

Compromise assessment

Assess whether selected systems show evidence of unauthorised activity.

Scope validation

Confirm whether additional systems or accounts require investigation.

Evidence integrity verification

Use hashes and controlled handling to support evidence integrity.

Legal hold support

Assist with preserving approved digital records for legal processes.

Litigation support

Provide technical analysis and reporting for approved legal matters.

Disciplinary investigation support

Support internal investigations with documented technical findings.

Expert technical reporting

Prepare structured findings for management, legal advisers or insurers.

Executive incident report

Summarise incident cause, impact, response and recommendations.

Technical forensic report

Document evidence sources, methods, findings and limitations.

Incident chronology

Provide a detailed timeline of relevant events.

Impact assessment

Evaluate affected systems, accounts, data and business operations.

Data exposure assessment

Assess whether sensitive or personal information may have been accessed.

POPIA breach support

Support technical fact-finding relevant to personal-information incidents.

Regulatory reporting support

Provide selected technical information for authorised reporting processes.

Cyber insurance support

Provide selected evidence, timelines and reports for insurer requirements.

Law-enforcement liaison support

Prepare approved technical evidence for engagement with authorities.

Stakeholder communication support

Assist with accurate technical updates for management and affected parties.

Incident communication templates

Prepare selected internal and external response communications.

Board-level briefing

Explain incident impact, response and outstanding risk in business terms.

Remediation planning

Develop prioritised actions to close identified weaknesses.

Credential reset planning

Coordinate secure password, token and key changes.

Endpoint rebuild guidance

Define when systems should be cleaned, restored or rebuilt.

Server recovery guidance

Support secure restoration and validation of servers.

Cloud remediation guidance

Address compromised identities, permissions, services and configurations.

Firewall remediation guidance

Implement approved blocks, segmentation and access restrictions.

Email remediation guidance

Correct forwarding, mailbox rules, authentication and domain protections.

Backup integrity review

Assess whether backups are available, protected and suitable for recovery.

Recovery validation

Confirm that restored systems are secure and operating as intended.

Monitoring enhancement

Define additional logging, SIEM and alerting requirements.

Detection rule development

Create selected detection logic based on incident findings.

Incident response plan development

Document roles, procedures, escalation and communication requirements.

Digital forensics readiness assessment

Assess evidence sources, retention, logging and investigative capability.

Tabletop incident exercise

Test response roles and decision-making using a controlled scenario.

Ransomware tabletop exercise

Simulate ransomware response, communication and recovery decisions.

Business email compromise exercise

Test response to fraudulent email and account takeover.

Executive incident exercise

Prepare senior leadership for high-impact cyber incidents.

Incident response retainer

Provide pre-agreed access to response support and planning.

Continuous improvement review

Track remediation and strengthen response maturity over time.