Remote in minutes. On site the next day.
Some incidents need hands in the room. When yours does, SIRT responders come to your facility and arrive the next day, while our SOC keeps containing and investigating remotely around the clock.
Containment doesn't wait for responders to arrive. By the time they walk in, the investigation is already well underway.
Some incidents can't be fixed from a distance.
Most containment happens remotely within minutes. But when an attack is widespread, when the network itself can't be trusted, or when control systems are involved, there's no substitute for experienced people on site.
- Ransomware that reached many servers and workstations
- A network you can't trust for remote access anymore
- Control systems where changes need eyes on the equipment
- Physical evidence, or a suspected insider
- Rebuilds that need more hands than your team has
What happens when responders arrive.
We work alongside your team, in your building, until operations are back and the attacker is gone.
Brief with your team
We walk your leadership and IT staff through what we know so far, agree priorities and set up a working space and a communication rhythm.
Collect evidence and lock things down
Forensic images of key systems, memory captures and log collection, with physical isolation of network segments where it's needed.
Remove the attacker and rebuild
Rebuild affected servers and workstations from known-good images, reset credentials, and harden Active Directory so the same way in doesn't work twice.
Bring operations back in order
Systems come back in priority order, with control systems checked carefully before anything is reconnected.
Leave you stronger
Before we leave, you get a walkthrough of what we found and what we changed, and a plan for what comes next. Remote monitoring carries on.
The SOC never stops watching.
While responders work at your site, analysts keep watching every endpoint in TITAN for any sign the attacker is still active.
Ready for the room they walk into.
Forensic equipment
Everything needed to image disks and capture memory on site, without changing the evidence.
Clean rebuild tooling
Trusted media and tools to rebuild systems, so recovery doesn't depend on anything the attacker might have touched.
Out-of-band communication
If your email or chat may be compromised, we set up a separate channel so the attacker can't listen in on the response.
OT-aware responders
People who understand control networks and protocols, and work with your operators rather than around them.
Network engineering
Emergency segmentation and firewall changes, made by engineers who design and harden critical infrastructure networks every day.
Calm, clear leadership
An incident lead who keeps the room focused, the decisions documented and your leadership informed.
Help us hit the ground running.
You don't need to have everything prepared. But the more of this that's ready when responders arrive, the faster we can work. TITAN customers already have much of it in place.
- Building access for responders, with badges or an escort
- Administrator or break-glass credentials
- Network diagrams and an asset list
- Contacts for leadership, key vendors and your ISP
- Your cyber insurance policy and carrier contact
- A room to work from, away from the main office traffic
More on how SIRT works.
Need responders on site?
Call SIRT. We'll start containing the incident remotely right away and get responders on the way to you.
Know who's coming before you need them.
Talk to us about SIRT coverage, so the team that shows up already knows your network, your people and your priorities.