Incident Response Services

Suspect a breach? Our team can act fast. We've helped organisations across New Zealand navigate some of their most serious security incidents.
Get incident response support

Incident Response you can rely On

Bastion is a trusted incident response partner with a track record across hundreds of investigations, including complex matters involving insurers, legal counsel and government agencies. With locally based specialists and industry-recognised tools, we help organisations of all sizes respond decisively, preserve evidence and recover with confidence.

Incident Response done right

All security incidents follow a standard approach, primarily to ensure consistent outcomes for all our customers
Scope the incident
We work with you and any external vendors to fully understand the incident.
Identify, collect & preserve
We ensure key evidence sources are preserved at the earliest opportunity.
Process & analyse
We determine the most effective way to process the available evidence.

Why partner with Bastion for Incident Response

We’ve conducted hundreds of investigations over the years, often working closely with insurers, legal counsel, government agencies, partners, and vendors. Incident Response is what we do.
Qualified experts
We’re certified by globally respected organisations, including SANS and IACIS and provide unmatched, locally based expertise to support your security.
Decades of experience is
a phone call away
From business email compromise and phishing to espionage and advanced persistent threats - there’s little we haven’t encountered.
Equipped with what it takes
We leverage bespoke and industry-recognised tools to streamline every stage - from evidence collection through to final reporting.

Affected personally?

Bastion's incidentresponse services are designed for organisations and government.

If you've been personally affected by a cyber incident, scam, or data breach, CERT NZ providesfree support and guidance for individuals.

Visit cert.govt.nz or call 0800CERTNZ (0800 237 869) for personal assistance.
Contact us

Request incident response support

If you’re dealing with a breach or suspected attack now, complete the form.
We will contact you immediately.
Frequently Asked Questions

Frequently asked questions

From risk assessment to rapid response - we’re with you every step of the way.

Can you help us prepare before an incident happens?

Yes. Beyond active response, we offer DFIR retainers, incident response planning and tabletop exercises to help your organisation prepare for and reduce the impact of a cyber event.

Do you work with insurers and legal counsel?

Yes. We work alongside cyber insurers, legal teams and external advisors as part of incident response engagements. We understand the evidence and documentation requirements these relationships involve.

Can you help with forensic evidence collection?

Yes. Evidence preservation is a critical part of every engagement. Our certified forensic specialists collect and secure evidence in a way that holds up for insurers, legal counsel and if needed, court proceedings.

Do you provide emergency ransomware response?

Yes. Ransomware is one of the most time-critical incidents a business can face. Our team responds quickly to contain the threat, preserve forensic evidence and support your recovery - minimising downtime and data loss.

What types of incidents do you respond to?

We handle the full range - ransomware, business email compromise, phishing, data theft, insider threats, unauthorised access and more. If something doesn't feel right, we can help you assess it.

What should I do if I think I've been breached?

Contact us immediately. The sooner you get expert help, the more options you have - early response protects evidence and limits damage. Call us on +64 4 281 7534 or complete the form on this page.