Cyber Services

Cyber work with an evidentiary spine

Most cyber providers are built around prevention and monitoring. That is necessary work, but it answers only the easy question — is something wrong. The hard questions arrive afterwards, and they are legal ones: what was actually accessed, by whom, when, and can you prove it to a regulator, an insurer, a customer or a court. Those questions are answered by forensics, and a firm that cannot answer them will hand you to a vendor who can, several days too late.

Our cyber practice is built the other way round. It starts from what has to be provable, and works backwards into what must be logged, retained, segmented and controlled so that the answer exists when it is needed. That produces a slightly different environment from the one a pure managed-service provider builds: fewer shared credentials, more retention, tighter administrative access, and monitoring configured around the questions an investigation will ask.

What we deliver

Assessment. A real inventory, an identity and access review, external exposure, backup and restore verification, logging and retention, segmentation, and vendor risk. The deliverable is a ranked list of what would actually hurt, with remediation priced — and it is yours whether or not you engage us further.

Hardening and managed security. Multi-factor everywhere, conditional access aligned to how your people actually work, endpoint detection rather than consumer antivirus, patch cycles with a defined exception process, email authentication and mailbox-rule monitoring, and immutable off-site backups with restores tested and the results written down. Delivered alongside our IT practice where a client wants the whole environment run rather than advised on.

Incident response. Containment and evidence preservation as one action rather than two competing ones. Volatile data captured before machines come down, images taken before anything is rebuilt, logs pulled before retention windows close.

Digital forensics. Examination of endpoints, servers, mobile devices, cloud accounts and email tenants to establish what was accessed rather than what was merely reachable — the distinction on which every notification decision turns. Detailed in our forensics practice.

Insider risk and data loss. Departing-employee exfiltration, USB and cloud-sync analysis, and the litigation-facing work that follows. See data loss prevention.

Compliance-driven work. HIPAA, the FTC Safeguards Rule, PCI DSS, NIST SP 800-171 and CMMC for the defence supply base, and CJIS where a contract reaches criminal-justice information. We build to the control and hand you evidence an auditor, insurer or prime contractor can use.

The first hour of an incident

What clients do in the first hour determines what is knowable afterwards, so it is worth stating plainly. Do not reimage anything. Do not delete the mailbox rules. Do not have IT "clean it up" before anyone has looked. Isolate affected machines from the network but leave them powered where possible, because memory contains the evidence that disk does not. Preserve logs immediately — cloud tenants and network devices routinely retain for a period measured in days, and the most common reason a breach cannot be scoped is that the logging was never enabled or had already rolled.

Then call counsel and call us. Where an incident is likely to become a legal matter, the work is better run under privilege from the start, and we are accustomed to working in that posture.

What we will not do

We do not hack back. Accessing a system you do not own is a federal offence regardless of what that system did to you first, and "active defence" is a marketing term for it.

We do not access accounts, devices or systems without written authorisation from someone entitled to give it. A spouse's account, an ex-employee's personal email, a competitor's network — the answer is no, and the reason is criminal rather than ethical.

We do not negotiate with or pay extortion actors, and we do not promise that a payment produces a working key or that stolen data will be deleted. Payment carries sanctions exposure under Treasury guidance and it is a decision for you and your counsel; our role is to document it, not to drive it.

We do not guarantee recovery of encrypted or deleted data, and we do not guarantee attribution. Both are commonly promised and neither is reliably deliverable.

We do not certify you as compliant. We build to the control and produce the evidence; the determination belongs to the body asking the question.

We do not sell or develop offensive tooling or interception devices, and we treat a request for either as a reason to end the conversation.

The part most cyber vendors leave out

A large share of what is filed as a cyber incident is a personnel matter with a technical surface. The wire that went to the wrong beneficiary, the customer list that left on a USB drive, the credentials that were shared with a former colleague, the invoice fraud that succeeded because one person skipped a verification step. Those matters end in an interview, a termination, an insurance claim or a lawsuit — not in a patch.

Because we hold the investigative licence as well, the technical finding and the human investigation are the same file. Interviews are conducted properly, evidence is preserved before anyone is confronted, and the report is written to survive an employment tribunal and a civil claim. That is the continuity that vendor boundaries destroy, and it is why the firm is structured this way.

Engagement and pricing

Assessments are fixed-scope and fixed-price. Managed security is per user and per endpoint monthly, with covered scope, response targets and out-of-scope authority written down. Incident response is hourly with an emergency rate, and we will tell you at the outset which of the three shapes your matter probably is rather than starting the meter on an open-ended engagement. Retainer arrangements exist for organisations that want a known responder and a pre-agreed rate before anything happens — which is materially cheaper than negotiating during an incident.

Frequently asked questions