Reactive Compromise Assessment · After an incident
Something got in. Find out how, and how far.
When an incident has already happened, our investigators combine digital forensics, incident response and threat intelligence to find the root cause, size up the damage and define exactly what to contain and fix.
Why investigate
After an incident, guesswork is expensive. Get the facts.
Fix the real cause
Restoring systems without knowing how the attacker got in invites a repeat. Root cause analysis closes the actual point of entry.
Know the true extent
We establish which systems, accounts and data were affected, so containment, notifications and decisions rest on facts, not fear.
Reduce the chance of a repeat
Findings become concrete recommendations that close the weaknesses exploited and harden your posture against similar attacks.
How we investigate
Six stages. From first questions to final answers.
We work closely with your team from the first briefing, so the investigation fits the incident and your organisation's priorities.
Incident briefing
We work with you to understand what happened, what has been observed so far and what you need from the investigation.
Evidence collection
Logs, system data and security records are gathered from affected systems in a way that preserves their value as evidence.
Forensic analysis
Digital forensics and threat intelligence are applied to reconstruct the attacker's actions and pinpoint the root cause.
Impact assessment
We determine the extent of the damage: which systems, data and services were touched, and the risk this now poses.
Containment plan
We define the steps needed to contain the incident, remove the attacker's foothold and return to a secure state.
Reporting
You receive a clear account of cause, impact and actions, with recommendations to prevent similar incidents.
Investigation scope
What we establish, what we define and what you receive.
Expected outcomes: the root cause identified with clear steps to address it, decisions based on the confirmed extent of the damage, and reduced risk of a similar incident.
01 · Investigate
What we establish
Root cause of the incident
Attack path and methods used
Systems, accounts and data affected
Extent of the damage
02 · Contain
What we define
Containment steps
Remediation actions
Steps to restore a secure state
03 · Prevent
What you receive
Investigation report
Actionable insights and recommendations
Measures to prevent similar incidents
Track record
Forensic training chosen by NCSC, a ministry and the CBJ.
Judiciary · Jordan · 2025
NCSC Tahseen: executive arm for judges' training in digital investigations
Government · Jordan · 2025
CHFI forensic investigator training delivered for a ministry
Financial & banking sector · Jordan · 2025
CBJ Cybersecurity Bootcamp: selected to lead it, including ECIH and CHFI
Related services
Investigated today. Ready for next time.
An investigation answers what happened. These services help you detect earlier and respond faster.
Incident Response Retainer
Experienced responders on standby with a tailored IR plan, agreed before the next incident strikes.
Explore the retainerProactive Compromise Assessment
A planned check, with no incident suspected, that confirms whether attackers remain in your environment.
Explore PCAManaged Detection & Response (MDR)
Round-the-clock visibility, threat intelligence and structured response to help catch the next attack early.
Explore MDRForensics training
EC-Council CHFI for the people who will preserve and analyse evidence during your next incident.
View the CHFI courseFAQ
Investigating an incident, step by step.
What organisations ask when an incident has happened and they need answers fast.
How is RCA different from incident response?
Incident response is the broader process covering every aspect of managing an incident. RCA is a specific, focused investigation that establishes cause and impact, and the steps to contain, remediate and prevent recurrence.
We only suspect an incident. Is RCA right?
If there are concrete signs such as alerts, unusual activity or a third-party warning, yes. If you simply want assurance with nothing suspected, a proactive compromise assessment fits better.
What do you need from us at the start?
A briefing on what was observed and when, access to affected systems and logs, and a contact with authority to make decisions. Please avoid wiping or rebuilding systems before we speak.
Can the findings support legal or regulatory needs?
The investigation documents evidence, cause and impact clearly, which supports your reporting to regulators and legal advisers. Specific obligations depend on your sector and jurisdiction.
What will the final report include?
The root cause, how the attacker operated, the extent of the damage, the containment and remediation steps, and recommendations to prevent similar incidents in future.
Get answers after an incident
Tell us what happened. We'll uncover the rest.
Share what you have observed so far, and an incident investigator will contact you to agree scope, evidence handling and next steps.
Describe the incident and what you have seen
An incident investigator reviews the details
You receive an investigation scope and plan