Prepare for attacks. Get immediate help.
WithSecure™ Incident Readiness and Response
With the right partner and preparation, every organization can prevent incidents from becoming crises
Get a risk-based view of your whole attack surface before it is exploited.
Co-secure with us: Together we can build a confident cyber security incident response team trained and equipped to respond.
Data breaches in 2022 cost an average of $4.35m per incident. Average saving for organizations with an IR team that tested their response: $2.66m.1
Our promise
We guarantee expert support through every stage of an incident to minimize impact and help you recover. We will develop your incident response maturity so you can respond effectively to future incidents.
Success Stories
In an incident, first preserve evidence
A Telecommunications provider detects unauthorized transactions and turns to WithSecure for help.
Less haste, more speed
A Managed Services Provider acquires another business - and we help identify, contain and eject multiple threat actors.
Our services
Incident Readiness
Exercise and improve your incident response capability without interruption to your business
Emergency Incident Response Support
Under attack? We’ll step in to help
Incident Response Retainer
Provides priority access to incident response experts—with special focus on the first 72 hours following an incident
Take a deep dive into WithSecure™ cyber Incident readiness and response services
IT estate: 200 servers, one 30 terabyte database
Visibility: Antivirus, no EDR, SIEM with inconsistent log coverage
Timeline:
- Day 0: Investigated suspicious activity, identified several encrypted hosts, cut internet access, supported startup of DR environment
- Day 1: Identified BlackCat ransomware sold as a service on Russian dark web forums
- Day 1-6: verified that backups were not compromised before uploading them to DR environment
- Day 4: Performed Attack Surface Mapping to spot and minimize potential vulnerabilities which would enable a DOS attack. Four DOS vulnerabilities, one Remote Code Execution vulnerability plus a DOS protection workaround discovered. Co-working with the client remediated all issues within hours.
- Day 10: Countercept XDR deployed as IT environment restored to production.
Total: 250 hours of Incident Management, forensic support and threat hunting.
Outcome:
- No ransom paid
- IT domain hardened and capability improved
- Client was assured that no sensitive data was exfiltrated
- Root cause of the incident identified
Chainsaw
The tool we are releasing today – Chainsaw – provides blue teams with a powerful first-response capability to quickly identify threats within event logs.
Unleashing the Power of Shimcache with Chainsaw: Novel Analysis Methods for Shimcache
Read moreCat-Scale Linux Incident Response Collection
On 30 September 2019, Joani Green and John Rogers gave a talk titled "Performing Linux Investigations at Scale" at the SANS DFIR Summit in Prague.
Read more- If you know which service(s) you’re interested in, you can contact us below or find a suitable partner from our partner locator
- If you want to discuss with our experts to understand which service(s) fit your needs the best, you can contact us below
- You can contact us below or get in touch with your current partner to discuss other services we're offering
- If you would like to change your current partner, you can contact us below to discuss possibilities with us or locate other potential partners from our partner locator
Visit our partner offering section and contact us to become a partner.
How do I get started?
1
Book a call
Book a meeting with one of our security experts to see WithSecure Incident Readiness and Response service in action.
2
Get pricing information
Get no-obligation pricing information for the WithSecure Incident Readiness and Response service, customized to your needs.
3
Find a dedicated partner
We’ll help you find the perfect partner to get the best out of our solution.
Want to talk in more detail?
Complete the form, and we'll be in touch as soon as possible.
Related Resources
Keeping attackers out: golden tickets, silver tickets, and full domain recovery
Not just another blog post on golden tickets. This guide explains how to remediate silver—as well as golden—ticket attacks and recover from a domain controller compromise.
Read moreNo Pineapple! –DPRK Targeting of Medical Research and Technology Sector
During Q4 2022, WithSecure™ detected and responded to a cyber attack conducted by a threat actor that WithSecure™ have attributed with high confidence to an intrusion set referred to as Lazarus Group. Attribution with high confidence was based off of overlapping techniques tactics and procedures as well as an operational security mistake by the threat actor. Amongst technical indications, the incident observed by WithSecure™ also contains characteristics of recent campaigns attributed to Lazarus Group by other researchers.
Read moreTrue Forensics Uncovered SE01 E01: Hidden in Plain Sight
Lifting the lid on cyber forensics with a true crime thriller. This first article in a new series shows how investigators uncover evidence during an incident and use it to contain and eradicate the attacker.
Read moreIncident to containment - and beyond to productivity
Automating security responses often gets a great response time – right down to milliseconds in some cases. Doing this creates all kinds of new problems and a fast response is not always the best way to dislodge a sophisticated attacker.
Read more- Slide 1
- Slide 2
WithSecure constantly conducts investigations and research to develop techniques, tools and practices to help with incident response and help organizations improve their readiness. It also has a dedicated Threat Intelligence practice to keep track of attackers’ behaviors, developments and tooling.
