Incident Response Services

When something looks wrong, the first hours shape everything after them. Core-Infosec helps you contain the incident, work out what happened and recover with evidence you can stand behind.

Talk to an incident responder

Call our 24/7 staffed hotline at 231-350-3171, or book a free 30-minute incident response call to talk through what you are seeing and what to do first. Prefer to write? Email info@core-infosec.com or use the contact form. We reply to form and email enquiries by the next business day.

Incident response services

Digital Forensics

Evidence collection and analysis for endpoints, servers, Microsoft 365 and cloud logs, with documented handling and clear findings.

BEC and Microsoft 365 Investigation

Investigation and containment of mailbox and account takeover: inbox rules, app grants, sign-ins and mail flow.

Ransomware Response

Containment, root cause, data theft questions and recovery support when ransomware is involved.

How an engagement runs

  1. Assess. We scope which identities, systems and data may be affected and agree priorities with you.
  2. Contain. We help you stop the activity: reset credentials, revoke sessions and tokens, remove threat actor persistence and isolate affected systems. Containment is not delayed to preserve evidence; we capture what we need as we go.
  3. Investigate. We analyze logs and system artifacts to build a timeline: how the threat actor got in, what they touched and whether they came back.
  4. Recover. We help restore safe operations and document the impact for your leadership, insurer, bank and counsel as needed.
  5. Harden. We recommend the specific changes that would have made the incident harder to carry out or easier to detect.

Incident response retainers

A retainer sets up the relationship before you need it: who to call, who decides, what access we need and where your logs live. That removes the scramble at the start of an incident. Ask us how a retainer would work for your organization.

What you receive

  • A forensic timeline of the intrusion
  • A statement of what was and was not accessed, based on the evidence available
  • Verified containment steps, not just a password reset
  • A plain-English executive report with a technical appendix
  • Prioritized hardening recommendations, including ongoing monitoring through CMDR

Experience

Our team has delivered hundreds of assessments, has worked with large enterprises including Fortune 50 organizations, and has experience with HIPAA, FISMA and ISO frameworks and with nation-state and APT-level threat actors.

Talk to an incident responder

Book a free 30-minute incident response call, or call our 24/7 staffed hotline at 231-350-3171. Prefer to write? Email info@core-infosec.com or use the contact form. We reply to form and email enquiries by the next business day.