What Needs to Be Contained
Limit further unauthorised activity while taking account of critical operations and preserving the evidence needed to understand the incident.
01 / The Service
Recovery Means Resolving the Compromise
Cyber incident response services bring together containment, investigation, eradication and recovery support. The objective is to resolve the incident without losing sight of what caused it.
Establish What Happened
Examine available records to establish initial access, attacker behaviour, affected systems and any supported evidence of information exposure.
Address the Conditions Behind the Compromise
Address identified persistence, compromised credentials and relevant weaknesses so restoration does not simply recreate the conditions of compromise.
The precise work and outputs depend on the incident and the agreed engagement scope.
02 / Recognise the Incident
Recognise the Signs of a Wider Compromise
Security incidents are not always announced by a ransom note. The visible symptom and the wider compromise may be very different things.
Ransomware & malware
Systems are unavailable, files are encrypted or malicious software has been detected.
QUESTION TO RESOLVEDid the attacker reach other systems or access data before the visible disruption?
Business email compromise
A suspicious payment instruction or unexpected mailbox behaviour raises concerns about account access.
QUESTION TO RESOLVEWas this an isolated fraudulent message or part of a wider identity compromise?
Privileged account misuse
Unexpected administrative changes, account activity or permissions suggest unauthorised access.
QUESTION TO RESOLVEWhich credentials, sessions and access paths can still be trusted?
Suspected data exposure
Evidence suggests that sensitive information may have been accessed, copied or transferred.
QUESTION TO RESOLVEWhat does the evidence establish about the data involved, and where are the gaps?
Unexplained cloud or network activity
Unfamiliar connections, changes or security alerts indicate potentially unauthorised activity.
QUESTION TO RESOLVEIs the anomaly legitimate, isolated or part of a larger incident?
03 / First Engagement
Get Specialist Help Before the Picture Is Complete
The starting point is understanding what's known, what's suspected and what assistance is needed. The first conversation should clarify the situation and establish the appropriate engagement route.
01 What systems or services are affected?
02 What response actions have already been taken?
03 Who can authorise investigation and containment?
Response times and mobilisation commitments depend on the agreed service terms.
STAGE 01
Establish the Situation
Establish the Situation
Separate confirmed information from suspicions and identify immediate business priorities.
STAGE 02
Agree the Priorities
Agree the Priorities
Balance necessary technical measures with operational impact and decision authority.
STAGE 03
Organise the Response
Organise the Response
Establish roles, communication, access and a practical route into technical work.
04 / Response Method
From Suspected Compromise to Safe Recovery
Containment can begin while investigation continues. New evidence changes priorities. A disciplined response keeps technical work and operational decisions connected, without pretending every incident follows a rigid script.
01
Establish the scope
Review what is known, which assets and business services may be affected, what has already happened and where the important gaps are.
CRITICAL DECISIONWhat needs attention first?Expected information: An initial scope and priorities
02
Contain the compromise
Assess appropriate controls such as endpoint isolation, account restrictions, session revocation or network changes while considering operational impact and evidence preservation.
CRITICAL DECISIONWhich interventions are justified and authorised?Expected information: Containment decisions and action record
03
Reconstruct attacker activity
Correlate available endpoint, identity, system, network and cloud evidence to investigate initial access, subsequent activity, persistence and potential exposure.
CRITICAL DECISIONWhat can we establish, and what remains uncertain?Expected information: Supported chronology and technical findings
04
Remove access and persistence
Address identified malicious mechanisms, compromised credentials, relevant misconfigurations and exploitable weaknesses; coordinate changes with system owners.
CRITICAL DECISIONWhich conditions must change before restoration?Expected information: Prioritised eradication and remediation actions
05
Support safe recovery
Work with responsible teams to assess restoration priorities, verify affected services, identify dependencies and avoid reintroducing known weaknesses.
CRITICAL DECISIONWhat can safely return, and who approves it?Expected information: Recovery guidance and validation priorities
06
Review and strengthen
Translate investigative findings and response lessons into corrective actions, changes to procedures and longer-term security improvements.
CRITICAL DECISIONWhat is urgent now, and what enters the improvement plan?Expected information: Lessons, findings and improvement priorities
Stage descriptions explain the response discipline. Specific activities and deliverables are agreed per engagement; this is not a fixed SLA or guarantee of outcome.
05 / The Investigation
Build a Clear Picture From the Evidence
Finding the visible symptom is not enough. Forensic investigation connects records from different systems to understand attacker activity, affected scope and the limits of what can be established.
FORENSIC WORKSPACE / CONCEPTDATA SOURCES → FINDINGS
EndpointDevice artefacts
IdentityAuthentication records
NetworkTraffic and telemetry
CloudAudit records
⟶⟶⟶⟶
INVESTIGATION OUTPUTIncident
chronology
chronology
Supported findings, affected scope, and uncertainty
Illustrative investigation model · Not an actual customer incident
Endpoint & server evidence
What ran, changed or persisted?Process history, files, system artefacts and relevant event records can help explain execution and persistence. Coverage depends on the artefacts available.
Identity & email evidence
Which accounts and sessions were involved?Authentication records, account changes, privileges and mailbox activity help investigate identity compromise and business email fraud.
Network & security telemetry
Where did activity move or communicate?Network connections, security alerts and retained telemetry can connect actions across systems and highlight potential lateral movement.
Cloud & SaaS records
What happened in hosted services?Audit trails, account activity and administrative changes can clarify access and alterations in supported environments.
Cross-source chronology
How do these findings fit together?Events from different systems are correlated into a supported sequence, with missing records and uncertainty recorded rather than concealed.
06 / Decision-Ready Outputs01 02 03 04 05
Incident Findings That Support the Next Decision
Useful incident reporting makes clear what has been established, what has been addressed and which risks or actions remain. It should not require senior leaders to interpret raw technical evidence.
Five output categories · Scroll to explore
Incident chronology
An evidence-grounded sequence of relevant events, affected systems and material unknowns.
Technical findings
Investigation conclusions concerning access, activity, persistence and the likely scope of compromise.
Containment record
The significant controls and response actions taken or recommended, plus any unresolved actions.
Recovery considerations
Dependencies, validation requirements and security conditions affecting restoration.
Executive findings
A decision-focused account of known impact, outstanding risks and prioritised improvements.
Candidate output categories: final documents, formats and inclusions require confirmation in the agreed scope.
2-sec / CASE NOTES
ILLUSTRATIVE REPORT STRUCTUREIncident Findings
Incident Findings
& Next Steps
01Incident chronology and affected scope
02Evidence-led technical findings
03Containment and remediation record
04Recovery dependencies and priorities
Illustration only · Not a real customer report
07 / Collaboration
Specialist Response That Works With Your IT Team
An incident response consultancy should add specialist capability without obscuring who owns the systems, who can approve disruptive actions or who is responsible for restoration.
Internal IT & system owners
Environment knowledge, access, operational dependencies and implementation of agreed actions.
SOC or MDR provider
Existing telemetry, alerts, incident records and coordination with monitoring and detection work.
Business & incident leadership
Operational priorities, approvals and communication across the organisation.
Insurers & legal advisers
Relevant engagement or evidence requirements where applicable; approval and legal responsibilities remain distinct.
CONNECTED EXPERTISE
08 / Engagement Options
Incident Response Support for Your Situation
Dealing with a suspected compromise, arranging a retainer and testing your readiness call for different conversations. Choose the situation that matches yours.
An Incident Is Happening or You Suspect One
Describe what you have observed, which systems may be affected and what has already been done. Start an enquiry about the incident response support you need.
You Need a Provider on Contract
Discuss activation procedures, response commitments, service scope and commercial arrangements before an incident puts those decisions under pressure.
Explore Response Options ↓You Want to Test Your Readiness
Discuss your response plans, tabletop exercises and the roles or coordination questions your organisation needs to work through.
09 / Evidence, Not Assurances
Incident Response Experience and Credentials
Choosing an incident response company means evaluating what its people can investigate, which credentials are relevant and what its documented work demonstrates, not reading a penetration testing testimonial placed on the wrong page.
Publication requirement: confirm CREST CSIR status and scope, approved incident case evidence and any permitted credentials or logos. No fabricated result is used here.
EVIDENCE PACK / TO BE COMPLETED
Evidence Behind the Response
Credential: Verified current incident response accreditation and the holder's scope.
Case evidence: An approved anonymised incident summary: situation, 2-sec's role, work carried out and documented outcome.
Example output: A genuine authorised, redacted report excerptor an explicitly labelled illustrative structure.,
10 / Buyer Questions
Choosing an Incident Response Provider
These are the questions that determine engagement fit, responsibilities and contractual clarity, not SEO filler about whether incident response is important.
Can we engage 2-sec without an existing retainer?
Ad hoc availability and contractual terms need to be confirmed with 2-sec. Emergency engagement and a pre-arranged retainer have different activation, commercial and response arrangements.
How quickly can a specialist begin work?
The applicable agreement should distinguish acknowledgement, specialist engagement and commencement of technical activity. Confirm which SLA applies and when its response clock starts.
Can 2-sec coordinate with our SOC, MDR or IT provider?
The engagement should define its technical lead, information-sharing arrangements, access permissions and responsibility for implementing actions. Existing telemetry and response records can be important investigation inputs.
Which systems and cloud environments can you investigate?
Scope depends on the platforms, available records, technical access and specialist capability. Ask for confirmation of supported environments and any third-party dependencies before agreeing the work.
Can you determine whether data was taken?
Evidence can support conclusions about access or transfers, but absent logging does not prove that exfiltration did not occur. Findings need to reflect the available records and their limitations.
Can you work with our cyber insurer and legal advisers?
Any coordination depends on policy conditions, approvals and the agreed role. An accreditation is not the same as insurer-panel approval, and technical investigation does not automatically confer legal privilege.
Who rebuilds or restores the affected infrastructure?
Investigation, security remediation and infrastructure restoration may sit with different teams. The engagement should specify what 2-sec performs, supports or hands over.
What influences scope and cost?
The nature of the incident, technical complexity, affected environments, evidence availability and specialist effort can influence the engagement. Fees and obligations belong in the agreed proposal or retainer.
11 / Your Next Move
Get Incident Response Support
Get specialist advice on a suspected compromise, response readiness or the appropriate engagement route.
If you suspect an active incident, telephone 2-sec to discuss the appropriate response route. No response time is implied by this page.