Prepare for attacks. Get immediate help.
WithSecure™ Incident Readiness and Response
With the right partner and preparation, every organization can prevent incidents from becoming crises
Get a risk-based view of your whole attack surface before it is exploited.
Co-secure with us: Together we can build a confident cyber security incident response team trained and equipped to respond.
Data breaches in 2022 cost an average of $4.35m per incident. Average saving for organizations with an IR team that tested their response: $2.66m.1
Our services
Incident Readiness
Exercise and improve your incident response capability without interruption to your business
Emergency Incident Response Support
Under attack? We’ll step in to help
Incident Response Retainer
Provides priority access to incident response experts—with special focus on the first 72 hours following an incident
In an incident, first preserve evidence
A Telecommunications provider detects unauthorized transactions and turns to WithSecure for help.
Less haste, more speed
A Managed Services Provider acquires another business - and we help identify, contain and eject multiple threat actors.
Our promise
We guarantee expert support through every stage of an incident to minimize impact and help you recover. We will develop your incident response maturity so you can respond effectively to future incidents.
Why choose WithSecure™ Incident Readiness and Response services?
Take a deep dive into WithSecure™ cyber Incident readiness and response services
IT estate: 200 servers, one 30 terabyte database
Visibility: Antivirus, no EDR, SIEM with inconsistent log coverage
Timeline:
- Day 0: Investigated suspicious activity, identified several encrypted hosts, cut internet access, supported startup of DR environment
- Day 1: Identified BlackCat ransomware sold as a service on Russian dark web forums
- Day 1-6: verified that backups were not compromised before uploading them to DR environment
- Day 4: Performed Attack Surface Mapping to spot and minimize potential vulnerabilities which would enable a DOS attack. Four DOS vulnerabilities, one Remote Code Execution vulnerability plus a DOS protection workaround discovered. Co-working with the client remediated all issues within hours.
- Day 10: Countercept XDR deployed as IT environment restored to production.
Total: 250 hours of Incident Management, forensic support and threat hunting.
Outcome:
- No ransom paid
- IT domain hardened and capability improved
- Client was assured that no sensitive data was exfiltrated
- Root cause of the incident identified
Chainsaw
The tool we are releasing today – Chainsaw – provides blue teams with a powerful first-response capability to quickly identify threats within event logs.
Unleashing the Power of Shimcache with Chainsaw: Novel Analysis Methods for Shimcache
Read moreCat-Scale Linux Incident Response Collection
On 30 September 2019, Joani Green and John Rogers gave a talk titled "Performing Linux Investigations at Scale" at the SANS DFIR Summit in Prague.
Read moreKeeping attackers out: golden tickets, silver tickets, and full domain recovery
Not just another blog post on golden tickets. This guide explains how to remediate silver—as well as golden—ticket attacks and recover from a domain controller compromise.
Read moreNo Pineapple! –DPRK Targeting of Medical Research and Technology Sector
During Q4 2022, WithSecure™ detected and responded to a cyber attack conducted by a threat actor that WithSecure™ have attributed with high confidence to an intrusion set referred to as Lazarus Group. Attribution with high confidence was based off of overlapping techniques tactics and procedures as well as an operational security mistake by the threat actor. Amongst technical indications, the incident observed by WithSecure™ also contains characteristics of recent campaigns attributed to Lazarus Group by other researchers.
Read moreTrue Forensics Uncovered SE01 E01: Hidden in Plain Sight
Lifting the lid on cyber forensics with a true crime thriller. This first article in a new series shows how investigators uncover evidence during an incident and use it to contain and eradicate the attacker.
Read moreIncident to containment - and beyond to productivity
Automating security responses often gets a great response time – right down to milliseconds in some cases. Doing this creates all kinds of new problems and a fast response is not always the best way to dislodge a sophisticated attacker.
Read moreWithSecure constantly conducts investigations and research to develop techniques, tools and practices to help with incident response and help organizations improve their readiness. It also has a dedicated Threat Intelligence practice to keep track of attackers’ behaviors, developments and tooling.
Want to talk in more detail?
Complete the form, and we'll be in touch as soon as possible.
Our accreditations and certificates
