Active incident? Do not wait for all 10 answers. Call now.
When a cybersecurity incident happens, the first few hours matter.
Proactive Risk Digital Forensics & Incident Response (DFIR) helps organizations investigate, contain, document, and recover from cybersecurity incidents.
Call Proactive Risk 24/7. If the attack is happening right now, do not wait until you have answers to all 10 questions. Call us immediately.
Tell us what you know.
Don't worry about diagnosing the incident yourself.
Tell us what you observed and let our incident responders investigate the cause.
Be prepared to provide:
The incident discovery date and actual compromise date may not be the same.
Establishing an accurate timeline is one of the first objectives of an incident-response investigation.
Tell us whether:
An active compromise may require immediate containment before the broader forensic investigation begins.
If you believe the attacker is still inside your environment, call Proactive Risk immediately.
Create a quick list of potentially affected technology.
Even an approximate number helps us establish the initial investigation scope.
An investigation involving one compromised Microsoft 365 account is very different from an incident involving 100 endpoints, multiple servers, domain administrator credentials, and possible data exfiltration.
Consider whether affected systems contained:
It is important to distinguish between data that may have been:
Unauthorized access does not automatically mean that information was stolen.
Determining what the attacker actually accessed or removed may become an important part of the forensic investigation.
We initially need an estimate, not necessarily an exact number.
The scope of an investigation can change significantly between an incident involving one employee account and an incident potentially affecting thousands of individuals.
If personal information may be involved, determining the number and residency of potentially affected individuals may also become important for legal and regulatory analysis.
Do not intentionally delete potential evidence.
Preserving this information can help investigators determine what happened, when it happened, how the attacker gained access, and what the attacker did after gaining access.
Tell us exactly what happened after the incident was discovered.
Do not hide mistakes or unexpected changes.
Knowing exactly what was done helps investigators understand what evidence may still be available.
Tell us whether you have notified or engaged:
Knowing who is already involved helps establish communication responsibilities, reporting requirements, and the appropriate investigation workflow.
You don't need to know exactly which forensic services you need. Start by telling us the business problem.
"We think someone accessed our Microsoft 365 environment."
"Our files are encrypted and there's a ransom note."
"We think employee information was stolen."
"Someone transferred money after receiving a fraudulent email."
"We discovered an administrator account being accessed from another country."
"Our cyber insurance company told us we need an incident-response firm."
Proactive Risk will use the available information to establish the appropriate incident-response scope.
If possible, speak with an incident responder before taking destructive remediation actions.
Unless immediate safety or business circumstances require otherwise, avoid unnecessarily:
Document:
WHO did WHAT to WHICH SYSTEM and WHEN.
Evidence preservation can be important for:
Is the threat still active, and what needs to be isolated immediately?
The priority is preventing additional damage while preserving evidence whenever practical.
What happened, how did it happen, and what did the attacker do?
We work to establish the incident timeline and investigate available forensic evidence.
Which systems, identities, information, and business processes were potentially affected?
Establishing scope helps guide remediation, recovery, legal review, insurance coordination, and potential notification requirements.
What needs to happen to safely restore operations and reduce the likelihood of recurrence?
Recovery may include credential resets, hardening, configuration changes, system restoration, monitoring, and remediation recommendations.
Depending on the incident, Proactive Risk may provide:
For organizations operating in New Jersey, a cybersecurity incident and a legally reportable data breach are not necessarily the same thing.
New Jersey maintains mechanisms for reporting cybersecurity incidents and data breaches to appropriate state authorities.
The technical investigation performed following an incident can help establish facts that management and qualified legal/privacy counsel may use to determine applicable notification requirements.
Important notice: Proactive Risk does not provide legal advice.
Organizations should work with qualified legal/privacy counsel to determine whether an incident constitutes a legally reportable breach and which federal, state, contractual, insurance, or industry notification requirements apply.
If you believe:
Call immediately.
When you call, start with three things:
We'll take it from there.
Proactive Risk Digital Forensics & Incident Response
CONTAIN. INVESTIGATE. SCOPE. RECOVER.
