Home / Services / Incident Response
INCIDENT RESPONSE & RESILIENCE
Incident Response
Incident support, 24 hours a day, seven days a week.
CyberXpert investigates suspected cyber incidents and supports containment and recovery. Call for incident support or send an incident enquiry so we can understand the situation and agree the next steps.
INCIDENT ENQUIRIES
Send an incident enquiry
Briefly describe what has happened and provide a safe way to contact you. You do not need to diagnose the incident before asking for help. Fields marked * are required.
Do not include passwords, confidential logs, system images or personal records. We will agree a secure route for any evidence needed. Our Privacy Notice explains how we handle enquiry information.
WHO THIS HELPS
Support for suspected compromise.
For organisations dealing with suspected account compromise, malicious activity, ransomware or unexplained access to business systems.
THE PROBLEM TO SOLVE
Uncoordinated changes can disrupt recovery or destroy useful evidence. A named decision-maker, a clean communication route and a recorded timeline help bring order to an uncertain situation.
What you receive
Agreed outputs may include an investigation timeline, evidence references, findings, containment records and prioritised recovery or remediation recommendations. Reports distinguish established facts from hypotheses and identify missing evidence that limits conclusions. See the digital forensics and incident response scope.
How delivery works
CyberXpert performs the agreed technical investigation. We establish your business priorities, technical contacts and the decisions the investigation needs to inform. We agree the relevant systems, collection approach and access requirements, then analyse the available evidence and discuss findings with the people responsible for technical and business decisions.
Evidence and confidentiality
Collection, transfer, handling and retention arrangements are agreed for the engagement. Tell us about legal, insurance, regulatory or other evidential requirements during scoping. Evidence availability, retention and changes to affected systems can influence what can be established. A post-incident review can identify control gaps and readiness improvements.
What shapes scope and price
Incident scale, affected systems, available evidence and recovery requirements shape the work. Incident support is available 24/7; response targets and engagement terms are agreed for the specific incident.
EVIDENCE-LED INVESTIGATION
Digital forensics and incident response
01
Establish the investigation questions, systems in scope, authorisation and evidence-handling arrangements before technical work begins.
02
Collect and review relevant account activity, logs and system evidence. Develop an evidence-supported timeline and assess relevant access, persistence and the extent of compromise.
03
Support authorised containment and recovery decisions. Actions such as isolating a system or restricting an account are recorded and coordinated with your nominated decision-maker and IT team.
04
Produce findings, evidence records and prioritised containment, remediation or recovery recommendations. Explain limitations and address specialist investigation or evidential requirements agreed for the engagement.
For preparation, understand incident investigation evidence and findings.
Also read how controlled service recovery works for restoration prerequisites and business acceptance decisions.
Questions worth asking.
Should I send logs or passwords with an initial enquiry?
No. Share only a brief description and safe contact details. Secure evidence-transfer arrangements are agreed separately.
Can you help with business email compromise?
The scope may cover account activity, mailbox rules, relevant audit logs and recovery coordination. Financial and legal reporting decisions require the appropriate internal owners and advisers.
What needs to be agreed before incident work starts?
Incident support is available 24 hours a day, seven days a week. Before technical work starts, we agree an authorised contact, scope, access and containment authority, together with secure evidence handling.
How do you work with our existing IT team during an incident?
CyberXpert performs the investigation and coordinates recovery with your incident lead. Your IT team or provider supplies environment knowledge and implements authorised changes within its responsibilities.
What happens after the immediate incident is stabilised?
The follow-up can document findings, recovery decisions and priorities to reduce recurrence. A lessons-learned review and improvement work can be scoped separately. Legal, regulatory and insurance decisions should stay with the appropriate business owners and advisers.
Plan your incident response
For non-urgent readiness planning, retainers and planned discussions, book a consultation. If you suspect an active cyber incident, call +44 (0)20 4591 7000 or submit an incident enquiry.
Ransomware response support →
Incident response retainer →
Incident readiness and exercises →
Prepare an incident response plan →