INCIDENT RESPONSE: Bring structure to an unfolding incident.
Incident response investigates suspected compromise and coordinates the technical work needed to contain the activity and support recovery. Subdux examines available evidence, assesses affected systems and helps carry out response actions, while preserving the information needed to understand what happened and guide the next decisions.
- Discipline
- Managed Security & Advisory
- Engagement type
- Advisory
You do not need a complete explanation before asking for help.
Unexpected account access, changed payment instructions, ransomware or unexplained administrative activity can begin with incomplete information. We work from what is known, identify the decisions that cannot wait and develop the investigation as evidence becomes available.
In your initial message, describe the affected systems, what you observed and when it began. Use a communication channel you believe is unaffected. Do not send passwords, sensitive records or forensic images through an ordinary enquiry form.
Limit the impact without losing sight of what happened.
Establish the working picture
Identify affected accounts and systems, important business dependencies and the evidence currently available.
Choose proportionate containment
Assess the effect of restricting access, isolating devices or interrupting services before acting within the agreed authority.
Investigate the intrusion
Trace relevant activity, assess how access may have been obtained and look for signs that it extended further.
Support a controlled return
Help address the conditions involved, plan restoration dependencies and identify checks before services resume normal use.
Technical findings need to reach the people making decisions.
Response can involve IT teams, executives, legal advisers, insurers and other providers. We explain confirmed findings, working hypotheses and unresolved questions separately, so decisions can reflect the evidence available at the time. Investigation updates and an incident record help maintain that common picture.
Legal advice, notification duties and insurance requirements need the appropriate advisers. We can provide relevant technical findings to support those discussions within the agreed engagement.
Can you respond if we are not already a client?
Describe what you have observed, the affected systems and the urgency. We agree availability, access and response arrangements with you before accepting the engagement.
How does incident response differ from a compromise assessment?
Incident response addresses suspected or confirmed harmful activity and the actions needed to limit its impact. A compromise assessment is a defined investigation into whether evidence of intrusion exists across a selected environment and time period.
Will the investigation establish everything the attacker did?
The findings depend on the systems and records available, their quality and retention, and whether activity has altered or removed evidence. We explain material limits alongside our conclusions.
Tell us what you have observed.
Share the situation, affected services and a safe way to reach you. We will establish whether we can assist and how the response should begin.
Related services: Incident Readiness & Tabletop Exercises.