Experienced responders ready to help

Security incidents can generate unexpected challenges, needing experts to coordinate, contain, and eliminate threats while preserving.

Talk to an expert

Incident Response

Expert-led, scalable incident response that uncovers root causes, contains threats, and supports recovery efforts.

We scale to meet the demands of each incident, deploying the right people to see it through from start to finish. Our core team of 12 specialists can expand to 20 when needed, and with access to over 150 professionals across Bastion, we’re confident we can bring the right expertise to any situation.

Scalable to meet your needs
Local experts, ready to respond
Transparent and competitive pricing

Service detail

Expert responders ready to uncover the facts

Ransomware incidents, business email compromise, data breaches, unauthorised access, and misconfigurations that expose systems. These are just some of the real-world situations we’ve helped organisations respond to and recover from.

Reduce the impact, manage the fallout

Delays in engaging incident response experts can extend recovery time and costs, while increasing the risk of prolonged business disruption or critical service outages.

Specialist cyber legal counsel available to advise on your obligations and regulatory response during security incidents.
Our Security Engineers assist in threat containment,system recovery, and resilience strengthening.
We integrate with your EDR to monitor threats and ensure recovery assurance.

Our delivery process

Incident Response done right

All security incidents follow a standard approach, primarily to ensure consistent outcomes for all our customers

Scope the incident

We work with you and any external vendors to fully understand the incident

Identify, collect & preserve

We ensure key evidence sources are preserved at the earliest opportunity

Process & analyse

We determine the most effective way to process the available evidence

Benefits

What sets us apart

We’ve conducted hundreds of investigations over the years, often working closely with insurers, legal counsel, government agencies, partners, and vendors. Incident Response is what we do.

Qualified experts

We’re certified by globally respected organisations, including SANS and IACIS and provide unmatched, locally based expertise to support your security

Decades of experience is a phone call away

From business email compromise and phishing to espionage and advanced persistent threats - there’s little we haven’t encountered.

Equipped with what it takes

We leverage bespoke and industry-recognised tools to streamline every stage - from evidence collection through to final reporting.

What comes next

Expand your security coverage

Some incidents stem from gaps in governance, design or security controls. We’ll work with you to identify practical solutions to help prevent future issues.

Security roadmap - a journey for continuous and targeted improvement
Augment existing security teams with managed endpoint, cloud or identity security tooling

Talk to an expert

Instructor Led ISO27001 Training

This instructor-led course equips participants with the knowledge and skills needed to become certified to lead, plan, and conduct ISO 27001 audits.

Advanced OSINT Training Course

This hands-on course teaches advanced open-source intelligence techniques, tools, and tradecraft for investigations, threat profiling, and situational awareness

Frequently asked questions

From risk assessment to rapid response - we’re with you every step of the way.

Is there a free consultation or assessment?

Yes. We provide access to our experts to help scope the issue. After this initial consultation, you'll have a clear understanding of the potential next steps, estimated costs, and expected timelines.

How much does incident response cost?

Costs vary depending on the complexity and severity of the incident. We offer transparent pricing and can provide estimates after an initial assessment. Retainer clients receive priority support and discounted rates. For certain cases, we also offer fixed pricing to provide cost certainty.

Do you offer post-incident reports or recommendations?

Yes. We can conduct a comprehensive Post-Incident Review that considers multiple perspectives. This may include interviews with key stakeholders, a review of existing governance structures, an assessment of security controls, and analysis of reports from vendors or third parties. Following this process, we’ll deliver a detailed PIR outlining what occurred, how it was managed, and actionable recommendations to strengthen your security posture moving forward.

Do you offer retainers?

Our DFIR (Digital Forensics and Incident Response) retainer goes beyond the typical offerings in the market. We view it as a long-term, strategic partnership focused on preparedness and prevention - not just response. Unlike bloated retainers filled with unnecessary costs, ours are lean, purpose-built, and tailored to meet the specific needs of our clients. The goal is to ensure you're always ready, without paying for what you don’t need.