You're in the incident. Every decision under guesswork costs more.

Breach Response & Forensics is live-incident work. Containment, evidence preservation, root cause investigation, attacker eviction, regulatory and customer communications coordinated with counsel, and the post-incident program work that keeps the same thing from happening again.

Talk to us

Why This Matters

The IR plan that exists as a document is not the IR plan that runs during the incident. Under pressure, organizations execute the version they have practiced.

Most IR plans are written once, filed, and never opened until the first hour of a real incident. When the call comes in at 2 a.m., the document does not help. People execute on instinct, training, and the relationships they already have. If the team has never rehearsed together, the first hour is spent assigning roles, finding contact information, and reconstructing the playbook from memory. The decisions that determine the next thirty days get made in that fog.

The work is making the plan operational before it is needed. Playbooks written to the scenarios that actually reach your sector. Tabletops with the executives, legal, and external partners who would actually be on the call. Communications drafted for customers, regulators, and the board so they are not written under pressure. Retainers in place with forensics, breach counsel, and crisis PR before the engagement letter has to be negotiated during the incident. The version of the plan that runs is the version the team has practiced.

By The Numbers

241 days

average time to identify and contain a breach in 2024. The decisions made in the first hours determine how much of that is spent in damage control vs. recovery.

IBM · Cost of a Data Breach Report 2024

10 days

median attacker dwell time before detection in 2023, down from 16 days the year prior. The detection window has shrunk, but the response window has not

Mandiant · M-Trends 2024

$2.66M

average savings on the cost of a breach for organizations with an incident response team that tests its plan regularly, compared to those without.

IBM · Cost of a Data Breach Report 2024

Three situations where the response is already in motion.

Who This Is For

Situation 1

Active incident, no retainer in place

Something is happening right now. Ransomware, suspected exfiltration, business email compromise, cloud account takeover. There is no retainer signed and no incident commander in seat. The clock is already running on regulatory and customer obligations.

Situation 2

In-house team in the lead, needs senior backup

Your security team is running the response. They are competent, and they are stretched. You need a senior incident commander shadowing the lead, a forensics team running the deep investigation, and a senior partner managing the executive and external communications stream while the internal team focuses on the technical work.

Situation 3

Post-incident, before the closeout

The incident is mostly contained. The technical team is exhausted and ready to return to normal. The closeout work is what determines whether the same incident repeats: root cause closed, lessons documented, regulators satisfied, customers communicated to, evidence preserved for the inevitable litigation discovery.

Best Outcome

Engagement opened within the hour. Containment and investigation running in parallel. Communications coordinated with counsel. The legal framework established before the next decision is made.

Best Outcome

A scaled response. Your team retains operational lead. Our team adds depth on forensics, communications, and the regulatory clock. Continuity preserved through fatigue.

Best Outcome

A disciplined closeout. Root cause closed, not papered over. Disclosure obligations met. Evidence preserved. After-action report written to the audience that matters.

Six streams run in parallel
from hour one. Each one has a named owner.

A real breach response is not a linear sequence. Six work streams run concurrently from the first hour, each with its own owner, its own clock, and its own deliverable. Sequenced incorrectly, any one of them becomes the finding the regulator cites.

How It Works

Stream 1

Command

A named incident commander in the room from hour one. Decision authority documented. Cadence set. The single throat to choke and the single source of truth for the executive team.

Stream 2

Containment

Attacker eviction, isolation of affected systems, credential resets, and the technical actions that stop the active damage. Coordinated with the investigation so containment does not destroy the evidence.

Stream 3

Forensics

Evidence preservation, timeline construction, root cause analysis, attacker attribution where possible. Conducted to the standard a regulator and a court will accept, under counsel for privilege protection.

Stream 4

Notification Clocks

SEC, NYDFS, HIPAA, state AG, customer contractual obligations. The clocks running concurrently, the decision criteria documented, the evidence trail an investigator would need on file.

Stream 5

Communications

Customer notifications, regulatory disclosures, board updates, internal communications, and (when warranted) press. Drafted with counsel, approved by the executive sponsor, released on the right cadence.

Stream 6

Recovery & Closeout

Restoring operations safely. Root cause closed, not bandaged. After-action documentation captured for regulators, customers, the board, and the next incident. Lessons fed into the IR program.

Decisive incident leadership when every hour counts.

What's Included

After this engagement, you will have:

A senior incident commander in seat

Named partner running the response. Decision authority documented. Cadence set with the executive team. The single point of truth for internal coordination and external partners.

After this engagement, you will have:

Regulatory clock management

Notification obligations identified and triaged. SEC, NYDFS, HIPAA, state AG, contractual customer notifications. Decision framework documented and applied with counsel. The evidence trail an investigator would expect on file.

After this engagement, you will have:

Forensic investigation to evidentiary standard

Evidence preservation, timeline construction, root cause analysis, and attacker attribution where possible. Conducted under counsel, documented for regulators and courts, written for the audience that needs to read it.

After this engagement, you will have:

Privilege-protected engagement structure

Engagement contracted through breach counsel where appropriate to preserve attorney-client privilege over the investigation work product. The right answers in the right legal envelope.

After this engagement, you will have:

Communications coordinated with counsel

Customer notifications, regulatory disclosures, board updates, internal communications. Drafted, legally reviewed, approved, and released on the right cadence. The first hour is spent on facts, not on first drafts.

After this engagement, you will have:

A handoff into the IR program

Every finding feeds the planning program. Playbooks updated, tabletops scheduled to test the gaps surfaced, controls hardened against the root cause. The same incident does not recur.

After this engagement, you will have:

An after-action report written for multiple audiences

Regulator-ready version. Customer-ready version. Board-ready version. Internal lessons-learned version. The narrative is consistent across all of them; the depth and language adjust to the reader.

After this engagement, you will have:

Containment without compromising the investigation

Technical actions sequenced so attacker eviction does not destroy the evidence the forensic team needs. Containment and investigation running together, not against each other.

Four ways breach responses fail in public. The specific decisions we make instead.

The post-breach litigation, regulatory penalties, and reputational damage usually trace back to one of these four mistakes. The technical incident is rarely the issue. The decisions around it are.

What We Don't Ship

Containment that destroys evidence

The instinct is to wipe and restore. The result is a containment that satisfies the technical urgency and an investigation that cannot answer the regulator's questions. We sequence containment and evidence preservation in the same plan, so both objectives are met.

Notification clocks missed

SEC four-day disclosure, NYDFS 72-hour notification, HIPAA breach reporting. The technical team is heads-down; the clocks run anyway. We staff a regulatory stream from hour one, with counsel in the loop and a decision framework that does not depend on the technical team for clock management.

Communications outside privilege

Internal emails and Slack messages discussing the investigation are subject to discovery. The findings the regulator cites are sometimes the findings the team wrote in unprivileged channels. We work under counsel, with a documented protocol for what gets recorded where.

Root cause not closed

The pressure to declare the incident over is intense. Closing without addressing the actual root cause is the most common pattern behind repeat incidents in the same organization. We hold the line on closeout standards and feed every finding into the program work that keeps it from recurring.

Four phases, run concurrently for the first 72 hours, then sequentially through closeout.

How It Works

Phase 1

Engage

Incident line answered within the hour. Senior incident commander in the room. Engagement contracted through counsel where appropriate. Forensic team mobilized. Cadence set with the executive team and the named external partners.

Phase 2

Contain & Investigate

Containment and forensic investigation run concurrently. Attacker activity halted. Evidence preserved. Timeline constructed. Root cause analyzed. Regulatory clocks tracked, notifications drafted, communications coordinated with counsel.

Phase 3

Communicate & Disclose

Customer notifications, regulatory disclosures, board updates, internal communications released on the right cadence. Drafted with counsel, approved by the executive sponsor. The narrative is consistent across audiences.

Phase 4

Close & Harden

Operations restored safely. Root cause closed in the program, not bandaged. After-action reports produced for the audiences that need them. Findings handed off to the IR planning program and the broader security roadmap.

You Walk Away With:

An engagement contract in place, under counsel where appropriate.
A senior incident commander on the cadence call.
A forensic team mobilized to begin evidence preservation.

You Walk Away With:

Containment executed without destroying evidence.
A forensic timeline and root-cause analysis under counsel.
Notification clocks tracked with the decision framework applied.

You Walk Away With:

Customer and regulatory notifications released on cadence.
Board and internal communications coordinated with counsel.
A consistent narrative across all external and internal audiences.

You Walk Away With:

Operations restored with root cause closed.
After-action reports for regulator, customer, board, and internal audiences.
A documented handoff into the IR planning program and the security roadmap.

Differentiator: XXXX

A governance framework grounded in regulated-industry research — not a consulting template.

Our framework is built from active research with clinicians, compliance officers, and AI practitioners in the industries that can't afford to get it wrong — health systems, financial services, insurance. It's anchored to NIST AI RMF and ISO 42001, and it's the same framework we operate behind every Fortellar Secure AI engagement.

Operating Posture

76%

Engineer-led coverage

76%

Engineer-led coverage

76%

Engineer-led coverage

76%

Engineer-led coverage

XXXXX

Expertise This Work Draws On

The components behind a defensible breach response.

Cybersecurity & Compliance

Incident Command

Senior incident commanders with continuity across boards, regulators, customers, and law enforcement. Decision authority documented, cadence set, external coordination managed from one seat.

Technology & Security Operations

Digital Forensics & Investigation

Evidence preservation, timeline construction, root cause analysis, and attacker attribution. Conducted to evidentiary standard and under counsel where appropriate.

Cybersecurity & Compliance

Regulatory Notification & Disclosure

SEC four-day disclosure, NYDFS 72-hour notification, HIPAA breach reporting, state AG, and contractual customer notifications. Decision framework, evidence requirements, clock management.

Cybersecurity & Compliance

Crisis Communications & Privilege Protection

Customer, regulator, board, and internal communications drafted and released under counsel. Privilege-protected engagement structure where appropriate. The narrative consistent across audiences.

See Expertise

Secure AI
Activation

Need the inventory and governance baseline first? Start here before handing agents to a managed service.

Where clients go after migration.

AI Agent
Build

Need agents built before they can be managed? We design and build them to the same ops discipline that will run them.

Security Operations & Monitoring

Your SOC already covers the estate. Managed Agent Services extends that into the AI layer without a parallel team.

Where To Next

Learn More

The cost of waiting another twelve hours is paid for years.

The incident line is staffed 24×7 with a 1-hour engagement SLA. Senior partner on the first call. Forensic team mobilized in the second hour. Counsel coordination in the third. Bring the situation, we will run the response.

Talk to us