A team you can call when the clock is already running.
24-hour response
When an incident is live you need someone in the environment fast. Our response starts within 24 hours — containment first, so the damage stops while the investigation begins.
Containment, forensics, root cause
We contain the active threat, run the forensics to establish what happened and how far it reached, and drive to a root cause you can trust — not a guess that leaves the door open.
A remediation roadmap, not just a report
The engagement ends with a prioritized roadmap to close the gap that let the incident happen and harden what it exposed — so the same thing doesn't happen twice.
The problem: the worst time to find a responder is mid-incident
When an intrusion is live, every hour spent finding help is an hour the attacker keeps working. Logs roll over, evidence is overwritten, and the pressure to “just rebuild it” destroys the very data you need to understand what happened. The organizations that come through an incident well are the ones that had a responder on call before the bad day — and the ones that at least know who to call the moment it starts.
This is the incident-response practice at the offensive-security side of KnytX. The same team that attacks systems in our application penetration testing and hardware security engagements works the response, so an investigation is led by people who know how attackers actually operate. Browse the services hub for how the engagements fit together, or approach it from the problem side at find and fix vulnerabilities.
Engagement scope
Incident response is available two ways, and the scope follows how you engage us:
- Retainer — set up before you need it. You get a guaranteed response window, a team that already knows your environment, and pre-agreed terms so there is no procurement scramble mid-incident.
- Ad-hoc — reach out when something is already wrong. We scope and mobilize fast, prioritizing containment while the rest of the response spins up.
Either way, a live engagement moves through the same phases: contain, investigate, eradicate, recover, and learn.
Methodology
We lead with containment — stop the active threat and preserve evidence before anything is rebuilt. Then forensics: establish the timeline, the initial access, the scope of what was reached, and whether data left. From there we drive to a root cause you can act on, guide eradication and recovery, and close with the lessons that turn the incident into a hardening plan. Throughout, we work alongside your team and, where relevant, your legal and communications stakeholders.
Deliverables
You receive an incident report with the timeline, the root cause, and the scope of impact stated plainly, plus a prioritized remediation roadmap to close the gap that allowed the incident and harden what it exposed. Retainer clients also get the pre-incident readiness work — environment familiarization and agreed response terms — that makes the live response faster.
Timeline
Response starts within 24 hours of engagement; a live incident is worked continuously until it is contained. Retainers are set up ahead of time on agreed terms. Because this is consulting, the path to start is a scoping conversation — request a quote to set up a retainer, or reach out now if something is already wrong.