Services
Digital Forensics and Incident Response
Digital forensics and incident response (DFIR) is the ground Greywell was founded on. When something goes wrong we establish what happened, how far it went and how to close it, and we leave you with a written account your insurer, your regulator and your board can follow.
What the Work Covers
- Investigation of compromised endpoints, servers, cloud tenants and email
- Root cause and scope: how they got in, what they touched and whether they are still there
- Containment and recovery planning alongside your IT team or managed service provider
- Incident response plans, playbooks and tabletop exercises for leadership and technical teams
- Retained incident response: agreed contacts, onboarding done in advance and response terms set out in the contract
- White label incident response capacity for managed service providers and partners, under your brand and your client relationship
What You Receive
- A forensic report with a timeline, the findings and the evidence behind them
- Recommendations to stop it happening again, in priority order
- Help with what you must report and to whom, including the National Cyber Security Centre (NCSC) and, where personal data is involved, the Information Commissioner's Office
Who It Is For
Organisations that want a response partner in place before they need one, and those dealing with something now.
If You Need Us Now
Email security@greywellcyber.com with URGENT in the subject line and a number we can call you on. Retained clients use the route and response terms in their contract.
How It Starts
For planned work or a retainer, tell us about your estate and what you have in place today. We will propose a scope and the onboarding steps.
Every engagement is scoped and contracted before work starts: what is in scope, what it costs, who does the work and when you will have the results.
Write to solutions@greywellcyber.com, or see the contact page.