Incident Response
When an attack is underway, call people who have handled one before.
Intuitus incident response stops the attack, removes the attacker and gets you running again, while preserving the evidence your lawyers, insurer and regulators will ask for.
Why it matters
A cyber incident becomes a legal event fast.
Most incidents set off notification deadlines, insurance claims and sometimes litigation. How evidence is handled in the first hours decides whether it holds up later, so we pair response with digital forensics from the start.
Ransomware
Containment, recovery and forensic investigation. Ransom negotiation and payment run through your law firm or insurer, because strict rules govern what a breached organization may do, and we work alongside them.
Business email compromise
Fast action on compromised mailboxes and fraudulent payment requests, then the investigation that follows.
Data breaches
Establishing exactly what data was affected, so notification decisions rest on evidence.
How we respond
What happens after you call.
In an active incident, call (253) 343-0004 or email services@intuituscyber.com. Referred by your law firm, insurer or MSP? We respond within 12 to 24 hours with a team to begin the incident response process. No referral and no contract? You can still call us directly, and we respond within 24 hours.
01
Contain
Stop the spread. Isolate affected systems and cut off the attacker’s access.
02
Investigate
Work out what happened, how, and what data was affected, using forensic methods.
03
Recover
Remove the attacker, close the way in and bring systems back safely.
04
Report
Root cause, a post-incident report and the changes that prevent a repeat.
Ways to engage
Before an incident, or in the middle of one.
Emergency response
Help during an active incident, from our 24/7 U.S.-based SOC and onsite when the situation calls for it, within 12 to 24 hours.
Incident response retainer
A contract set up before you need it, with a service level agreement covering response timing, your point of contact and the rules of engagement.
Incident Response Action Plan
A written plan that names who does what in the first hours of an incident.
Tabletop exercises
Rehearse ransomware and outage scenarios so your team has practiced the plan. Led by our CISO, on your premises with remote support, usually once or twice a year. We also run a remote Capture The Flag exercise.
You can engage Intuitus DFIR directly or through a partner already working with you. Most often that is your law firm, insurer, MSP or parent company. We hold partner agreements and can set the process up with them in advance.
Where it fits
Where the stakes after an incident are highest.
Law firms
Protect privilege and client confidentiality through a breach or wire-fraud incident. Learn more →
Healthcare
Breach response and the documentation that follows an ePHI incident. Learn more →
Defense contractors
DFARS 252.204-7012 gives defense contractors 72 hours to report a cyber incident. We help you meet it with evidence intact. Learn more →
Public safety & 911
Restore dispatch operations first, then investigate. Learn more →
What you receive
Evidence that holds up, and a way forward.
- Forensic evidence collected and preserved in a litigation-ready manner
- A secure, auditable chain of custody from collection to final disposition
- Root-cause analysis and a post-incident report
- Guidance for leadership that lines up with your legal and regulatory strategy
FAQ
Frequently asked questions
What is incident response?
Incident response is the work of containing an active cyberattack, removing the attacker, recovering systems and preserving evidence. Intuitus provides analyst-led incident response from its 24/7 U.S.-based SOC, and runs tabletop exercises so your team has rehearsed ransomware and outage scenarios before a real event.
What is DFIR?
DFIR stands for digital forensics and incident response. It combines stopping an attack with a forensic investigation of what happened, how it happened and what data was affected, with the evidence preserved so it holds up with regulators, insurers and courts.
What should we do first if we think we have been attacked?
Do not wipe or rebuild affected systems yet, because that destroys evidence. Disconnect affected devices from the network if you can do it safely, keep your logs, call your incident response provider, and tell your cyber insurer, since many policies require early notice.
What is an incident response retainer?
A retainer is a contract set up before an incident, with a service level agreement covering response timing, your point of contact and the rules of engagement, so expert responders are on call and nobody is negotiating terms in the middle of an attack.
Do you work with our lawyers and insurer?
Yes. Intuitus DFIR is built to support legal, regulatory and insurance processes. We work alongside your counsel, your insurer and your leadership so response decisions and evidence handling line up.
Related: Managed detection and response · Law firm security · Tabletop exercises · Trust Center