Incident Response

For retainer clients, we guarantee initial triage within 2 hours. For emergency engagements, we typically begin remote triage within 4-6 hours of first contact. On-site deployment in the DFW area can happen same day; nationwide travel is typically next business day. Organizations on our Citadel and Command plans already have 24/7 SOC monitoring, which means threats are detected and escalated before they become full-blown incidents.

Yes. We coordinate directly with your cyber insurance carrier and their panel counsel. Our forensic reports are structured to support insurance claims and meet the evidentiary standards carriers expect. Having an IR retainer in place before an incident can also reduce your cyber insurance premiums.

A managed SOC monitors your environment 24/7 to detect and prevent incidents before they happen. Incident response is what happens when prevention fails and a breach occurs. Think of the SOC as your security guard and IR as your emergency room. Ideally you have both. Our Citadel and Command plans include SOC monitoring with built-in incident escalation, reducing the likelihood of needing a standalone IR engagement.

First, do not shut down affected systems — powering off destroys volatile forensic evidence in memory. Disconnect compromised machines from the network but leave them running. Do not communicate about the incident over potentially compromised email. Call us at 512-518-4408 or submit an emergency request. Document everything you have observed with timestamps. Do not attempt to negotiate with ransomware operators on your own.

Yes. We help you determine notification obligations under applicable regulations including the Texas Data Breach Notification Act, HIPAA Breach Notification Rule, PCI DSS incident reporting, and state-specific laws. Our forensic analysis identifies exactly what data was accessed or exfiltrated, which determines the scope of required notifications. We coordinate with your legal counsel to ensure compliance with all deadlines and requirements.

Regular penetration testing significantly reduces the risk of a breach by finding vulnerabilities before attackers do. Combined with 24/7 SOC monitoring, email security, and dark web monitoring, you build layers of defense that make incidents far less likely. Our Command plan includes an annual pen test and full SOC coverage — the most comprehensive prevention package we offer.