Active incident? Call (07) 2150 3641
Incident response
When something is wrong in your environment, get engineers on it now.
If you have an active incident, call (07) 2150 3641, day or night. We contain it, find out what happened, recover your systems and fix the cause. If you don't have an incident, set up a retainer so the first hour is already planned.
During an incident
- Contain: isolate affected devices and accounts, block the attacker's access and stop the spread.
- Investigate: establish what happened, how they got in, what they touched and whether data left.
- Eradicate: remove persistence, reset credentials and close the way in.
- Recover: restore systems from clean backups in the order the business needs them.
- Root cause: a written report of what happened and the permanent fixes, for your leadership, insurer and regulators.
Your obligations
Incidents can carry reporting deadlines: the Notifiable Data Breaches scheme under the Privacy Act, APRA notification under CPS 234, and mandatory cyber incident reporting under the SOCI Act. We gather the evidence you need to make those decisions and work alongside your insurer, legal advisers and any forensic specialists they appoint.
Incident response retainer
A retainer means the first call is to people who already know your environment. It is a monthly fee with response targets written into the agreement.
- Response targets agreed in writing, with a direct number to call
- An incident response playbook for your environment, prepared in advance
- Access and contacts set up before they are needed
- An annual tabletop exercise with your leadership and IT team
- Agreed rates for incident work, so there is no negotiation during an incident
Prepared environments recover faster
Most of what decides how an incident goes is set up beforehand: logging that keeps the evidence, backups that attackers can't delete, admin accounts that are separated and protected, and a playbook that says who decides what. The retainer covers that preparation.
Questions buyers ask
We have an incident right now. What should we do?
Call (07) 2150 3641. Don't wipe or rebuild affected systems yet, because that can destroy evidence. If you can, disconnect affected devices from the network rather than turning them off.
Do you respond outside business hours?
Yes. Call any time, day or night.
Can you work with our cyber insurer?
Yes. Many policies appoint their own incident response panel, so check your policy first. We work alongside the insurer's panel or as your chosen provider, whichever the policy allows.
Do you do forensic investigations for legal proceedings?
Where evidence may be needed in court, we recommend bringing in a specialist forensic firm to handle the chain of custody, and we work alongside them while we contain and recover the environment.
How is incident response priced?
Emergency work is charged on time and materials. A retainer is a monthly fee that includes preparation and sets agreed rates for incident work.
Start a conversation
Plan the first hour of an incident before it happens.
Talk to us about an incident response retainer.
Talk to an Engineer