Incident Response & Digital Forensics
Contain the incident and preserve what you need to understand it.
During a suspected breach, an improvised fix can destroy the evidence needed to explain what happened. We support a controlled technical response: establish the facts available, contain the agreed threat, preserve relevant evidence and verify the path back to operation.
DIRECT ANSWER
Wavect supports scoped incident response and digital investigation, including triage, containment planning, evidence preservation, technical analysis and recovery verification. Access, decision authority, availability and the roles of legal or specialist advisers are agreed for the incident.
Best for
- Organizations investigating suspected compromise of their software or cloud systems
- Teams preparing an incident playbook and evidence-preservation process
Consider another approach
- An assumption of immediate response without a confirmed engagement
Identify decisions that cannot wait and facts that are missing
Confirm the incident lead, system owners and the authority to isolate services or revoke access. Build an initial timeline from available observations and distinguish confirmed facts from hypotheses. Your existing emergency contacts remain the first route until our availability and role are confirmed. The engagement does not create an always-on hotline or assume control over third-party systems.
Preserve relevant records before changing the environment
Agree what evidence is needed and how it can be collected without unnecessary exposure of personal or confidential data. Record source, time, collector, transformations and access history. Where relevant, preserve logs, configuration and system snapshots with integrity checks. Retention and transfer follow the agreed process; specialist forensic handling can be identified where the situation requires it.
Make the impact of each action explicit
Isolation, access revocation, key rotation and service shutdown can affect customers and evidence. We recommend bounded actions, obtain the agreed approval and record the change. Coordinating responders need a shared communication path and clear ownership. Managed Cloud Operations can supply separately contracted ongoing response coverage; this engagement addresses the specific incident or preparedness exercise.
Illustrative rehearsal: a compromised identity is contained
In a tabletop or test environment, an account is assumed compromised. The team checks its permissions, preserves relevant access records, approves revocation and verifies that legitimate service access can be restored through a clean identity. The timeline records decisions and unresolved questions. This is a preparation scenario, not a claim that a breach occurred or that attribution is certain.
Restore a service with a reason to trust it
Recovery criteria address the known entry path, affected data and the condition of backups or rebuilt systems. Test access, important transactions and monitoring before returning agreed traffic. A restored process is not proof that every risk has disappeared. Follow-up hardening belongs to Cloud Security and targeted verification may use Application Penetration Testing.
Keep technical findings separate from legal conclusions
Deliver a timeline, evidence inventory, observed impact, actions taken, limitations and prioritized follow-up work. Your legal, privacy and insurance advisers own reporting obligations and formal notifications. We do not promise attacker attribution or courtroom admissibility. The closeout names owners for unresolved questions, evidence retention and the next response rehearsal so the work remains usable after the immediate incident.
Questions before you start
No. Availability, secure communication and acceptance of the incident must be confirmed. Use your established emergency escalation while that is unresolved.
Attribution may remain uncertain. We report what the available evidence supports and keep hypotheses clearly separate from confirmed observations.
Those decisions and communications belong to your authorized legal and privacy owners. We can provide technical evidence for their assessment.
Yes. A scoped readiness engagement can establish runbooks, evidence collection, roles and a rehearsal using a relevant incident scenario.
Discuss incident-response support
Describe the situation at a high level without sending compromised credentials, personal records or raw evidence. Availability and a secure information-sharing channel are confirmed separately; this form is not an emergency hotline.