Critical incident response
A coordinated response when operations are at risk.
We support the technical management of serious incidents, from initial assessment and containment to service recovery and measures to prevent recurrence. When ransomware, a compromised account or a data leak stops the business, you need one team that decides what to isolate first, keeps the evidence intact, and brings services back in a safe order. We work alongside your IT team and management and keep communication clear throughout.
Business value
Limit incident spread and guide recovery with clear priorities.
Critical incident response
Four stages, each with a clear deliverable. Where AI helps, it is marked.
Triage, impact assessment and prioritisation
We establish what is affected, what is still trusted, and what must be protected first, within the first hours.
Triage and correlationContainment of affected systems and evidence preservation support
Isolate compromised hosts and accounts without destroying the traces that a later investigation will need.
Response assistanceRemoval of identified causes and controlled recovery
Remove the access the attacker used, rebuild or clean systems, and restore services in an agreed order with verification at each step.
Technical coordination, communication and post-incident review
One technical point of contact for management, a timeline of what happened, and a short list of measures to stop it happening again.
Incident timelineThree AI use cases, all optional
Optional. Every AI feature uses data you approve, can be switched off, and keeps a person in the loop.
Triage and correlation
Groups alerts and log events from different sources so the team sees one incident, not hundreds of signals.
Incident timeline
Builds a time-ordered reconstruction from logs and actions taken, ready for the post-incident report.
Response assistance
Suggests next containment steps based on the type of incident and the systems involved, reviewed by the responder.
A coordinated response when operations are at risk.
- Systems are encrypted, accounts are behaving strangely or data appears outside the organisation.
- Your team has contained an incident but is not sure the attacker is gone.
- Regulators, auditors or a parent company require a documented response and review.
Delivery with clear criteria.
Project, recurring service or specialist engagement. The model and indicators are defined in the proposal.
Assess
Goals, data, systems and constraints.
Design
Scope, architecture, integrations and plan.
Implement
Configuration, development and testing.
Validate
Acceptance, quality and knowledge transfer.
What clients ask us
How fast can you start?
Contact us by phone or WhatsApp during business hours. We start with remote triage; on-site support in Luanda follows as needed. Response times for contracted clients are defined in the agreement.
Will you need to shut everything down?
No. The aim is to isolate what is compromised and keep the rest running. Decisions on shutdowns are made with you, based on the triage.
Do you also investigate how it happened?
Yes. Evidence preserved during response feeds into Digital forensics, which establishes the sequence of events for management, insurers or authorities.
