- Home
- Incident Response & Forensics
- Incident response
When it goes wrong, you need a team that has done this before,
engaged without delay.
Mjolnir Response is NIST-aligned incident response for ransomware, business email compromise, intrusions and insider threats. A senior responder takes the case, containment starts remotely, and evidence is handled to a court standard from the first contact.
Containment first, then the full story, then the rebuild.
An incident is the worst time to be negotiating a contract or explaining your network to strangers. When you contact our incident team, a senior responder takes the case, not a dispatcher, and remote triage and containment begin while we scope the rest. With a retainer, response times are agreed in advance.
We work to the NIST incident-handling lifecycle: preparation, detection and analysis, containment, eradication and recovery, and post-incident review. Every artifact we touch is collected with a documented chain of custody, so the same evidence can serve your insurer, your regulator and, if it comes to it, a court.
You will not manage three conversations at once. We coordinate with your legal counsel, your insurer and the relevant regulators and law enforcement contacts, and we brief your executives and board in plain language as the picture develops.
- A senior responder on your case, with remote containment started early
- Scoping of what was touched, what was taken and how they got in
- Coordinated eradication, so every foothold is removed at once and the attacker is not tipped off
- Forensic evidence collected with chain of custody from the first call
- Regulatory notification support and executive and board briefing material
- A post-incident report with root cause and the hardening steps that close it
Four phases, aligned to NIST.
Prepare
Before anything happens: a retainer at agreed terms, playbooks written for your environment, and a team that already knows your escalation contacts and crown jewels.
Detect and analyse
We confirm what is happening, how far it has spread and what is at risk, using disk, memory, network and cloud evidence.
Contain, eradicate, recover
We isolate affected systems, map every persistence mechanism, remove the attacker in one coordinated move, and restore operations from clean sources.
Review and harden
A root-cause report, the evidence package, and a prioritized list of what to fix so the same route does not work twice.
The incidents that actually happen.
Ransomware
Containment, decryption feasibility, exfiltration assessment, and threat-actor negotiation when it helps, with sanctions screening first and law enforcement coordination throughout. We never recommend paying.
Business email compromise
The full chain traced: credential harvesting, mailbox rules and fraudulent transfers. We work with your financial institutions while recovery windows are still open.
Advanced intrusions
Persistence mapped across identity, cloud and endpoints, then removed in a single coordinated eradication rather than a partial clean-up.
Insider threat
Discreet investigation of misuse by staff or contractors, with evidence handled so it can support HR, civil or criminal action.
The parts of an incident that are not about malware.
- Regulatory notification support for the UAE PDPL, Saudi PDPL, Singapore PDPA and sector regulators
- Liaison with law enforcement, with evidence handled to support prosecution
- Insurer coordination and the forensic timeline a claim depends on
- Executive and board briefings written for decision-makers
- Expert witness testimony and litigation support
- Malware reverse engineering and indicators for blocking and hunting
Everyone, eventually
Every organization. It is the one service nobody should be without. If you are under attack now, contact our incident team. If you are not, put a retainer in place so the team answers first, at terms already agreed.
- IR retainer, agreed terms and guaranteed response from 4 hours down to 1
- Bifrost digital forensics, what was taken, by whom, to a court standard
- Mjolnir Shield rebuild, clean up and harden after containment
- MSOC, someone watching afterward, around the clock
What buyers ask.
We'll deal with it if it happens.
Then you will be signing contracts and explaining your network to strangers while your business is down. A retainer means the team answers first, at agreed terms, and already knows your environment.
Who actually handles our incident?
A senior responder, not a call centre. Remote triage begins on first contact, and a retainer fixes response times in advance, from 4 hours down to 1.
Will you negotiate with the attackers?
Yes, when it helps. Our responders negotiate with threat actors after identification and sanctions screening, to buy time, gather intelligence and protect your options while we contain and recover. We never recommend paying a ransom.
Our IT team has already started cleaning up. Is that a problem?
It can be. Rebuilding or wiping machines destroys the evidence that shows how they got in. Contact us before anything else is changed, and we will tell you what to preserve.
Will the evidence stand up if this ends up in court?
Yes. We collect with a documented chain of custody from first contact, and our Bifrost forensics examiners provide expert testimony when it is needed.
What happens once you have contained it?
We find the root cause and remove every foothold. Mjolnir Shield then rebuilds and hardens what was compromised, and MSOC can watch the estate around the clock afterward.
Under attack, or planning not to be?
Contact our incident team if it is happening now. Otherwise, talk to a responder about a retainer before you need one.