Add threat research and evidence coordination to your digital forensics and incident response process. Work alongside appointed responders within an agreed scope.
Contain the incident
Preserve public references
Assess affected systems
Organize the reporting record
Agree follow-up responsibilities
During an incident, responders need useful external context and an organized record without losing focus on containing the threat. We support the appointed response team with clearly assigned research and coordination tasks.
Internal security teams, specialist DFIR firms and counsel coordinating an incident. A named response lead remains responsible for operational incident management and decisions affecting systems.
Agree the incident question, authority, recipients and update cadence. Support can include lawful leak-source monitoring, campaign research, executive and social-account exposure, public-source preservation and timeline contributions. We distinguish unverified leak claims from corroborated observations and do not download stolen datasets or contact threat actors.
Your responders direct system containment, investigation of hosts and eradication. Any proposed forensic acquisition is separately assessed for qualified staffing, appropriate tools, legal authority and written scope before it can be offered.
Agreed intelligence updates, an exposure or leak-claim report with source limitations, entries for the master incident timeline, an evidence register and a post-incident summary. Deliverables go to the agreed response lead and authorized recipients.
A fictional company asks its responder to manage an incident while our analyst reviews public claims about the brand. The analyst preserves the public reference, labels the claim unverified, records timing and provides context. The responder decides how that information affects containment and communications.
Excludes: lead incident response, containment, eradication, managed detection, ransom negotiation, threat-actor payments and automatic attribution. A retainer is not a promise of continuous staffing or an emergency response team.
Onboard before an incident where possible: name the response lead, authorize sources and set escalation contacts. The draft DFIR Support Retainer includes 8 analyst hours monthly and a proposed 2-business-hour acknowledgment target during staffed hours. Active incidents use confidential intake; do not wait for this preview to get emergency assistance.
A clear description, public account references and confirmation that you own the assets or are authorized to act. We agree an evidence checklist after assessment. Never send passwords or verification codes.
No. Your appointed responder owns containment, system investigation and eradication. We agree research and coordination tasks with that lead.
No. We do not negotiate with, pay or engage threat actors.
A claim is not proof of compromise or of the contents alleged. We record the source, timing, corroboration and gaps without acquiring stolen datasets.
Preferably. Agree authority, sources, escalation contacts and distribution before activation. New incident requests still need conflict and scope checks.
No. The draft retainer covers agreed business hours. Any extended coverage must be separately staffed and contracted.
Case-led analysis, practical checklists and original sources.
Build an incident evidence record using lessons from the British Library, NIST guidance and clearly separated UK, US, UAE federal, DIFC and ADGM contexts.
Legal review pending
Read the analysis : Incident Evidence: A UK, US and UAE Response GuideTell us where you are. We’ll help you understand the route forward.
