Service · Incident Response
When detection becomes response, minutes matter.
Rapid containment, breach investigation, and regulatory filing for active incidents. Available as a retainer included in Fortress, as a standalone engagement, or as emergency response for non-clients.
What Incident Response Covers
From the moment we're engaged, we work to contain, investigate, and document the incident. Every action is preserved for forensics, regulatory filing, and litigation if it becomes necessary.
Immediate
Containment
Isolate affected endpoints, kill malicious processes, revoke compromised credentials, block command-and-control traffic. First-hour priorities, executed.
Investigation
Root Cause Analysis
How they got in. What they touched. What they took. Timeline reconstruction with evidence chain-of-custody preserved throughout.
Recovery
Eradication and Recovery
Remove attacker presence completely. Validate clean state before restoring operations. Document every step for post-incident review.
Regulatory
Breach Notification Drafting
Plain-language notification drafts for affected parties and regulators. Coordinated with your counsel before any filing.
Compliance
Regulatory Deadline Management
HIPAA 60-day clock. State 30-day notification deadlines. SEC material incident disclosure rules. We track them so you don't miss them.
Output
Final Incident Report
Defensible incident report suitable for counsel, board, and regulators. Built to withstand scrutiny.
How Incident Response Works
Engagement to containment in hours. Full closure in days to weeks depending on scope.
Step 1
Engage
Call our IR line or escalate from your monitoring console. We start the response clock and assemble the right team within the hour.
Step 2
Contain
Stop the bleeding. Isolate, kill, revoke, block. Establish a clean perimeter around the affected environment.
Step 3
Investigate
Forensic collection from affected systems. Timeline reconstruction. Identify scope, root cause, and data exposure.
Step 4
Close
Eradication, recovery, regulatory filing, final report. Documented post-incident review with corrective recommendations.
Why Carbynix for Incident Response
Most IR firms specialize. We integrate. The team responding is the team that knows your environment.
Operator Background
Our IR engineers come from DHS, CISA, NIH, USMC, and Google Mandiant. We've worked the response side of major incidents before, not just read about them.
Built-In Forensics
Forensic collection and chain-of-custody are part of every response, not an upsell. Reports are defensible from day one.
Regulatory Fluency
We've drafted and filed under HIPAA, state notification laws, FTC Safeguards, and federal breach reporting frameworks. We speak regulator.
No Discovery Discount
Other firms charge full discovery rates to learn your environment after an incident. If you're a Carbynix MDR client, we already know it.
How to Engage IR
Included with Fortress
10 hrs/mo
Fortress tier includes 10 hours of incident response per month. Hours roll over within your contract.
- Pre-negotiated rates for hours beyond the included retainer
- No SOW delay during an active incident
- Same engineers who monitor your environment respond to your incident
- Activated by phone or escalation from your console
Standalone Retainer
Contact for quote
Annual IR retainer for organizations not on Fortress. Hours scoped to your environment and risk profile.
- Hours bank against future incidents
- Pre-negotiated rates locked in
- Annual tabletop exercise included
- Optional ransomware specialty add-on
Emergency Response
Contact for quote
Active incident, no prior relationship. We'll engage if we have capacity. Premium rates apply.
- First call takes priority over scoping
- Containment actions begin while contracts are signed
- Standard IR deliverables (report, regulatory filing, recovery)
- Conversion to retainer or MDR available post-incident
Common Questions
How fast can you start responding?
For Fortress clients, response begins within minutes. For retainer clients, within the hour. For emergency engagements, response begins as soon as a master services agreement is in place. We can start containment work in parallel with paperwork when the situation requires it.
Will you work with our existing law firm during an incident?
Yes. Most incidents involve coordination with breach counsel and sometimes federal law enforcement. We've operated in those workflows before.
What happens to the incident report?
You own it. Final reports are delivered to you and your counsel. We retain a working copy for our quality processes but do not share incident details externally without your written authorization.
What about ransomware specifically?
Ransomware response is part of standard IR. We do not negotiate ransoms or process payments. We work with specialized partners when negotiation is the right path, but we focus on containment, eradication, and recovery from clean backups when possible.
If you're in an active incident, call us.
If you're not in an active incident and want to be ready for one, schedule a consultation about IR retainers and the Fortress tier.