DF&IR Playbooks

Rapid first-response triage to classify, scope, and prioritise any security event before full IR engagement. Determines whether an event is a genuine incident and assigns severity.

End-to-end ransomware containment, eradication, and recovery. Covers encryption detection, C2 disruption, decryption assessment, backup restoration, and post-incident hardening.

Rapid mitigation of volumetric, protocol, and application-layer DDoS attacks. Covers traffic analysis, upstream scrubbing activation, BGP blackholing, and post-attack hardening.

Detection, containment, and remediation of brute-force, credential stuffing, password spraying, and account takeover attacks across identity providers, VPNs, RDP, and web applications.

Full investigation of confirmed or suspected data breaches — quantifying exfiltrated data, identifying exfiltration channels, meeting regulatory notification obligations, and remediating root cause.

Proactive or post-incident deep-dive assessment to determine whether an environment has been compromised — identifying hidden threat actors, dormant malware, and undetected persistence mechanisms.

Covert investigation of malicious or negligent insider activity — covering data theft, sabotage, policy violations, and fraud — with full legal admissibility and HR/legal coordination.

Investigation and containment of BEC attacks — including account takeover, wire fraud, invoice manipulation, and CEO impersonation — with financial recovery coordination.

Investigation and remediation of cloud infrastructure breaches across AWS, Azure, and GCP — covering IAM compromise, data exposure, cryptojacking, and misconfiguration exploitation.

Long-term investigation of advanced persistent threat (APT) intrusions — characterised by extended dwell time, custom malware, living-off-the-land techniques, and strategic espionage objectives.

Investigation of software supply chain attacks — including malicious package injection, build pipeline compromise, vendor backdoors, and third-party software tampering.

Specialised response for operational technology and industrial control system incidents — prioritising safety, operational continuity, and forensic investigation without disrupting critical processes.