Make the next decision with confidence.
When an incident happens, establish what is known, contain risk and prioritise recovery.
How we can help
Support for organisations responding to suspected compromise, suspicious activity or data exposure.
Initial triage
Identify affected systems, known indicators and immediate priorities.
Containment and preservation
Balance reducing active risk with retaining information needed to understand the incident.
Recovery planning
Prioritise remediation, account security, monitoring and lessons learned.
Frequently asked questions
Should we wipe an affected device immediately?
Not automatically. Wiping can destroy useful evidence; containment and preservation decisions depend on the situation.
Can you help after an incident has already ended?
A retrospective review may still identify useful evidence and opportunities to prevent recurrence.
How CredTech can help
Investigation, containment and recovery support for cyber security incidents.
Initial containment
Triage the incident, identify affected systems and preserve useful logs before taking disruptive action where practicable.
Investigation and eradication
Establish a timeline, identify initial access and persistence, assess exposure and plan remediation with the business owner.
Recovery and lessons learned
Validate restored services, rotate affected credentials, improve controls and document decisions, evidence and remaining uncertainty.