Detect & Respond · Incident Response
Incident Response
How an organisation responds in the first hours of an incident shapes the outcome more than almost any control put in place beforehand. Readiness work now is what makes that response calm instead of chaotic.
Delivered from our base in Utrecht, available to organisations across the Netherlands.
The problem
Most organisations without a tested incident response plan discover its gaps during an actual incident: nobody's sure who has authority to make the call to isolate a system, contact details are out of date, and the backup that was supposed to be the safety net turns out to be reachable from the same compromised credentials as everything else.
Business impact
The cost of an incident is driven less by the initial compromise than by how long it takes to detect, contain and recover from it. Organisations with a tested plan and practiced team consistently resolve incidents faster and with less operational and reputational damage than those improvising in real time.
From building the plan to running the response, and the review that follows.
IR readiness & planning
An incident response plan written for the incident you'll actually have, with named owners and clear escalation paths.
Ransomware readiness
Specific preparation for the scenario that causes the most damage in practice: backup validation, isolation planning, and a communication plan decided before you need one.
Tabletop exercises
Walking your team through a realistic scenario before a real one forces them to improvise.
Investigation
Establishing what happened, how, and what was actually affected: the basis for every decision that follows.
Containment & eradication
Stopping an incident from spreading, then removing the attacker's foothold entirely.
Recovery
Restoring operations in a way that doesn't reintroduce the same weakness.
Post-incident review
A clear-eyed account of what happened and what changes as a result, not a document that gets filed and forgotten.
How this engagement runs
Assess
Understand the current state, real risk, and what's actually driving the need for this work.
Architect
Design the controls and approach that fit your environment, not a generic template.
Implement
Deploy and integrate the work: configuration, code, or process, whichever the engagement calls for.
Validate
Test that it actually holds up, rather than assuming it does because it's been deployed.
Improve
Feed findings back in as your environment and the threat landscape change.
Who this is for
- Organisations with no documented incident response plan
- Companies that have a plan but have never tested it with a tabletop exercise
- Businesses specifically concerned about ransomware readiness
- Organisations required to demonstrate IR capability for NIS2 or ISO 27001
What you get
- An incident response plan with named owners and escalation paths
- A ransomware-specific readiness assessment covering backups and isolation
- A tabletop exercise testing the plan against a realistic scenario
- Hands-on investigation and response support when an actual incident occurs
- A post-incident review with concrete follow-up actions
Frequently asked questions
We don't have an incident response plan at all. Is that unusual?
It's common, especially among SMEs, but it's also one of the highest-leverage gaps to close. The difference between a calm, practiced response and an improvised one under pressure is often the difference in how much an incident actually costs.
What should we do immediately after a suspected cyberattack?
Preserve evidence rather than immediately wiping systems, isolate affected devices from the network without powering them off (which can lose volatile evidence), and get an incident responder involved before making containment decisions that could destroy what you need for investigation. If you don't have a plan, that's exactly the gap we help close before it's needed.
Do you offer 24/7 incident response?
Response availability and SLAs are agreed per engagement. Ask us directly about what's realistic for your organisation. We don't claim always-on coverage we haven't verified we can deliver.
What's a tabletop exercise, and is it worth the time?
A structured walkthrough of a realistic incident scenario with your actual team, testing whether the plan (and the people) hold up under a simulated version of the pressure a real incident brings. It reliably surfaces gaps a written plan alone doesn't: unclear ownership, missing contact information, decisions nobody had actually made.