A breach has a playbook. We run it with you.
Every breach is different, but the way out shouldn't be improvised. SIRT follows a proven incident response process, adapted for organizations that run critical operations with lean teams.
Six phases. No guesswork.
Each phase has a clear goal, a clear owner and a clear point where we agree with you to move on.
Confirm it's real, and how bad
We confirm the incident, classify it, and work out which systems, accounts and data are involved. You get a first severity call and a plan for the next few hours.
Stop the spread without breaking operations
Short-term containment first: isolate hosts, cut attacker access, block their infrastructure. Then longer-term containment that keeps critical services running while the investigation goes on.
Find the way in and everything touched
Forensics on endpoints, logs, email and network traffic to find the entry point, the timeline, what the attacker accessed and anything they left behind to get back in.
Remove every foothold
Malware, persistence, rogue accounts, stolen credentials and the hole they came through. Nothing comes back online until it's clean.
Bring operations back, safely
Systems return in priority order from clean images and verified backups, with extra monitoring in place to catch any sign the attacker is trying to return.
Close the gap for good
A full report with the timeline, root cause and actions taken, plus a prioritized list of fixes. We walk your leadership through it.
The breaches we see most.
SIRT's playbooks cover the attacks critical infrastructure organizations actually face.
Ransomware
Contain the encryption, find out whether data was stolen as well, and restore from backups we've confirmed are clean.
Business email compromise
Hijacked mailboxes, forwarding rules and fraudulent payment requests, traced, shut down and documented.
Stolen credentials and VPN access
Attackers signing in as your staff. We lock the accounts, kill their sessions and find everywhere those credentials were used.
OT and SCADA intrusions
Suspicious activity near control systems, handled with your operators so containment never puts safety or service at risk.
Insider misuse
Investigated quietly and carefully, with evidence your leadership and counsel can rely on.
Data exposure
Work out exactly what was exposed and whose data it was, and watch for it surfacing on the dark web.
The hard calls, made together.
A breach brings decisions that aren't technical: when to disconnect, who to notify and what to tell the people you serve. SIRT gives you the facts to make each one, and helps you bring in the right people at the right time.
We work alongside the partners a breach pulls in, so they all hear one consistent account of what happened.
- Your cyber insurance carrier and breach coach
- Your legal counsel
- Law enforcement, including the FBI
- CISA and your sector's information sharing center
- Regulators, including NERC CIP-008 reporting where it applies
Documentation that holds up.
Insurance claims, legal questions and regulatory reviews all depend on what was recorded during the incident. SIRT preserves evidence from the first hour and keeps a timestamped record of every action.
- A complete, timestamped incident timeline
- Preserved forensic evidence with a chain of custody
- Root cause and the full scope of the compromise
- Every containment and recovery action, with who did it
- A board-ready summary and a prioritized fix list
More on how SIRT works.
In the middle of a breach?
Don't wait to read the playbook. Call SIRT and an incident lead will start working it with you right away.
Plan your breach response before the breach.
Talk to SIRT about agreeing contacts, escalation paths and access ahead of time, so the first hour is spent responding.