Fortellar

You're in the incident. Every decision under guesswork costs more.

Breach Response & Forensics is live-incident work. Containment, evidence preservation, root cause investigation, attacker eviction, regulatory and customer communications coordinated with counsel, and the post-incident program work that keeps the same thing from happening again.

Get Emergency Help Now
Why This Matters

The first 24 hours are decided before the technical work begins.

Most breaches are technical events with executive consequences. The forensic analysis matters, but the decisions that shape the next thirty days are about authority, sequencing, evidence preservation, regulatory clocks, and legal framing. Run those in parallel with containment and you finish in a defensible position. Defer them and you spend the next year in disclosure litigation.

The work is running the response and the investigation together. A senior incident commander from hour one, engagement under counsel for privilege, forensics a regulator and court will accept, and containment that preserves the evidence the investigation needs.

Decisions the first 24 hours force
01

Authority

Who is the incident commander, and what can they decide without a meeting.

02

Privilege

Whether the investigation is engaged under counsel, before the first finding exists.

03

Evidence

Containment that preserves what the investigation and a court will need.

04

Regulatory clocks

Which notification windows started, and when they actually started.

Who this is for

Three situations where the response is already in motion.

Situation 01

Active incident, no retainer in place

Something is happening right now. Ransomware, suspected exfiltration, business email compromise, cloud account takeover. There is no retainer signed and no incident commander in seat. The clock is already running on regulatory and customer obligations.

The outcomeEngagement opened within the hour. Containment and investigation running in parallel. Communications coordinated with counsel. The legal framework established before the next decision is made.
Situation 02

In-house team in the lead, needs senior backup

Your security team is running the response. They are competent, and they are stretched. You need a senior incident commander shadowing the lead, a forensics team running the deep investigation, and a senior partner managing the executive and external communications stream while the internal team focuses on the technical work.

The outcomeA scaled response. Your team retains operational lead. Our team adds depth on forensics, communications, and the regulatory clock. Continuity preserved through fatigue.
Situation 03

Post-incident, before the closeout

The incident is mostly contained. The technical team is exhausted and ready to return to normal. The closeout work is what determines whether the same incident repeats: root cause closed, lessons documented, regulators satisfied, customers communicated to, evidence preserved for the inevitable litigation discovery.

The outcomeA disciplined closeout. Root cause closed, not papered over. Disclosure obligations met. Evidence preserved. After-action report written to the audience that matters.
What's included

A response run so the incident ends in a defensible position.

A senior incident commander in seat

Named partner running the response. Decision authority documented. Cadence set with the executive team. The single point of truth for internal coordination and external partners.

Containment without compromising the investigation

Technical actions sequenced so attacker eviction does not destroy the evidence the forensic team needs. Containment and investigation running together, not against each other.

Forensic investigation to evidentiary standard

Evidence preservation, timeline construction, root cause analysis, and attacker attribution where possible. Conducted under counsel, documented for regulators and courts, written for the audience that needs to read it.

Regulatory clock management

Notification obligations identified and triaged. SEC, NYDFS, HIPAA, state AG, contractual customer notifications. Decision framework documented and applied with counsel. The evidence trail an investigator would expect on file.

Communications coordinated with counsel

Customer notifications, regulatory disclosures, board updates, internal communications. Drafted, legally reviewed, approved, and released on the right cadence. The first hour is spent on facts, not on first drafts.

Privilege-protected engagement structure

Engagement contracted through breach counsel where appropriate to preserve attorney-client privilege over the investigation work product. The right answers in the right legal envelope.

An after-action report written for multiple audiences

Regulator-ready version. Customer-ready version. Board-ready version. Internal lessons-learned version. The narrative is consistent across all of them; the depth and language adjust to the reader.

A handoff into the IR program

Every finding feeds the planning program. Playbooks updated, tabletops scheduled to test the gaps surfaced, controls hardened against the root cause. The same incident does not recur.

How it works

Four phases, run concurrently for the first 72 hours, then sequentially through closeout.

Phase 01

Engage

Incident line answered within the hour. Senior incident commander in the room. Engagement contracted through counsel where appropriate. Forensic team mobilized. Cadence set with the executive team and the named external partners.

You walk away with
  • An engagement contract in place, under counsel where appropriate.
  • A senior incident commander on the cadence call.
  • A forensic team mobilized to begin evidence preservation.
Phase 02

Contain & Investigate

Containment and forensic investigation run concurrently. Attacker activity halted. Evidence preserved. Timeline constructed. Root cause analyzed. Regulatory clocks tracked, notifications drafted, communications coordinated with counsel.

You walk away with
  • Containment executed without destroying evidence.
  • A forensic timeline and root-cause analysis under counsel.
  • Notification clocks tracked with the decision framework applied.
Phase 03

Communicate & Disclose

Customer notifications, regulatory disclosures, board updates, internal communications released on the right cadence. Drafted with counsel, approved by the executive sponsor. The narrative is consistent across audiences.

You walk away with
  • Customer and regulatory notifications released on cadence.
  • Board and internal communications coordinated with counsel.
  • A consistent narrative across all external and internal audiences.
Phase 04

Close & Harden

Operations restored safely. Root cause closed in the program, not bandaged. After-action reports produced for the audiences that need them. Findings handed off to the IR planning program and the broader security roadmap.

You walk away with
  • Operations restored with root cause closed.
  • After-action reports for regulator, customer, board, and internal audiences.
  • A documented handoff into the IR planning program and the security roadmap.
Expertise this work draws on

The components behind a defensible breach response.

Cybersecurity & Compliance

Incident Command

Senior incident commanders with continuity across boards, regulators, customers, and law enforcement. Decision authority documented, cadence set, external coordination managed from one seat.

See expertise
Technology & Security Operations

Digital Forensics & Investigation

Evidence preservation, timeline construction, root cause analysis, and attacker attribution. Conducted to evidentiary standard and under counsel where appropriate.

See expertise
Cybersecurity & Compliance

Regulatory Notification & Disclosure

SEC four-day disclosure, NYDFS 72-hour notification, HIPAA breach reporting, state AG, and contractual customer notifications. Decision framework, evidence requirements, clock management.

See expertise
Cybersecurity & Compliance

Crisis Communications & Privilege Protection

Customer, regulator, board, and internal communications drafted and released under counsel. Privilege-protected engagement structure where appropriate. The narrative consistent across audiences.

See expertise

Call before you know how bad it is.

We take control of the response, contain the damage, and give you a defensible account of what happened.

Get Emergency Help Now