Overview
US incidents come with overlapping clocks: SEC Form 8-K disclosure within four business days of a materiality determination, NYDFS reporting generally within 72 hours, FTC notice within 30 days for Safeguards Rule breaches affecting 500 or more consumers, and breach laws in all 50 states. Our responders contain the incident and establish the facts quickly, so counsel, insurers and leadership can decide on notifications.
Whether it's ransomware, a business email compromise, a data leak or a suspicious alert you can't explain, the first hours of an incident shape the outcome. Decisions about containment, evidence and communication made under pressure are hard to undo.
Our responders guide containment, coordinate investigation across endpoints, servers, cloud and email, and support eradication, recovery and hardening so the same path can't be used again. Deep forensic investigation and malware analysis are delivered by our Digital Forensics team as part of the response.
We provide clear reporting for leadership, insurers, legal counsel and regulators — including support for time-bound obligations such as NYDFS 72-hour reporting, the FTC Safeguards Rule's 30-day notice and SEC four-business-day disclosure.
Incident response for US organizations
- Facts gathered quickly for SEC, NYDFS, FTC Safeguards Rule and state breach notification decisions
- We work alongside your insurer's panel firms and outside counsel where a policy or legal strategy requires it
- Evidence preserved with chain of custody for insurers, counsel and law enforcement referrals
- Clear executive summaries for boards, customers and regulators, written in plain English
What's included
Our approach
- EngageInitial call, scoping and immediate containment advice.
- PreserveCollection of logs, images and artifacts with chain of custody.
- InvestigateTimeline reconstruction, root cause and data-impact assessment.
- Eradicate & recoverRemoval of attacker access and safe restoration.
- LearnPost-incident report and prioritized improvement plan.
What you receive
- Incident timeline and root cause
- Containment and recovery actions
- Retainer onboarding pack
- Tabletop exercise reports
- Executive, technical and regulatory reports
Standards & frameworks
- NIST SP 800-61
- ISO/IEC 27035
- NYDFS 500.17 (72-hour reporting)
- State breach notification laws
- SEC Form 8-K Item 1.05
Frequently asked questions
We think we've been breached — what should we do first?
Avoid powering off affected systems or wiping evidence, isolate them from the network where possible, preserve logs, and contact us immediately using the details on our contact page.
Can you work with our cyber insurer?
Yes. We can coordinate with insurers and legal counsel and produce reports suited to claims and legal review.
Do you offer incident response retainers?
Yes. A retainer pre-agrees terms and onboarding so responders can start immediately when you need them.
Can you help us meet breach notification deadlines?
We help you establish the facts regulators and counsel need: what happened, which data and how many people were affected, and what you have done in response. That supports decisions under state breach laws, the FTC Safeguards Rule's 30-day notice, NYDFS 72-hour reporting and SEC Form 8-K. The decision to notify, and the notification itself, stay with you and your counsel.
Can you support US organizations from India?
Yes. All services are delivered remotely by our team in India. India is 9.5 hours ahead of US Eastern time during US daylight saving time (10.5 hours in winter) and 12.5 to 13.5 hours ahead of Pacific time. Meetings and testing windows are agreed around your US time zone at scoping, and 24/7 services run around the clock.