Incident Response

Incident Response Consultation

Cyberus reviews the information available at the agreed time; this is not a walk-in facility and makes no response-timing promise.

Book an incident consultation See what a consultation covers

A scheduled incident discussion
Available facts and uncertainty
Evidence-preservation priorities
Qualified options and escalation needs

The proposition

Separate known facts from urgent assumptions

Bring an incident concern into a structured conversation that separates known facts from urgent assumptions. The work focuses on a scheduled incident discussion and records where evidence or authorization limits the conclusion.

A consultation helps frame the next decision

Early incident information is often incomplete. A structured consultation can clarify affected systems, business impact, actions already taken and evidence at risk before a larger scope is agreed.

The service is arranged through normal contact and scheduling. It is not represented as a walk-in facility or continuous hotline, and it does not replace emergency, legal or law-enforcement channels.

Clarity before the next move

Reported facts. What has been observed and what has already been done, kept apart from guesses.
Affected services and timing. Affected services, timing and constraints that determine how cautious any action must be.
Evidence at risk. Sources that could be lost or overwritten if left alone, and simple ways to protect them.
Next-step options. Choices on investigation, escalation or readiness, each with its trade-offs stated.

Why it matters

Business risk: Under pressure, teams may wipe systems or contact the wrong parties before they understand what they are dealing with.
Decision it supports: Leaders can decide whether to investigate, escalate or prepare further, knowing which facts are firm and which are open.
What you receive: You receive a written outline of facts, unknowns, evidence priorities, options and escalation notes, within the agreed scope.

A concise decision record

Situation summary

Separates reported facts, working hypotheses, unknowns and actions already taken.

Why it matters: Mixing facts with assumptions leads to confident but wrong decisions, so they are listed separately.
Supports: A sound footing for the next decision

Evidence priorities

Identifies potentially relevant sources and cautions against avoidable evidence loss.

Why it matters: Early habits such as rebooting or reimaging can erase the very records that explain an event.
Supports: Preserving material that may matter later

Option outline

Explains proportionate investigation, containment or coordination paths for consideration.

Why it matters: A short list of proportionate paths helps leaders act without over-reacting or doing nothing.
Supports: A choice between investigation, containment or coordination

Escalation notes

Records specialist, legal, insurer, regulator or internal owners that may need involvement.

Why it matters: Some incidents bring legal, insurance or regulatory duties that are easy to miss in the moment.
Supports: Knowing who else may need to be told

How a consultation is handled

Arrange the discussion
Use the published contact route and avoid sending sensitive evidence until a method is agreed.
Why it matters
A set route protects sensitive material from being sent over unsuitable channels before a method is agreed.
Establish known facts
Review timing, affected services, observations, business context and actions already taken.
Why it matters
Establishing timing and prior actions prevents the discussion from relying on unverified accounts.
Protect useful evidence
Identify sources at risk and proportionate preservation steps for the customer to consider.
Why it matters
Naming which evidence is at risk lets the customer act sensibly before a deeper engagement starts.
Outline next steps
Record uncertainties, escalation needs and a possible investigation or readiness scope.
Why it matters
A written outline turns an anxious conversation into something leaders can brief and approve.

Why choose Cyberus for incident response consultation

Format
Scheduled consultation
Input
Available incident information
Output
Qualified next-step options
Limit
Not a forensic conclusion

Team certifications

Individual qualifications held by members of the Cyberus team. They are not company accreditations, and not every consultant on an engagement holds every badge.

OSCP
Hands-on penetration testing skills, from enumeration to exploitation and privilege escalation.
OSWE
Web application security skills, including source code review and exploiting complex web vulnerabilities.
OSED
Exploit development skills, including analysing Windows software and writing custom exploits.
OSCP+
Hands-on penetration testing skills, from enumeration to exploitation and privilege escalation.
CRTA
Red team analysis skills, including adversary tactics and techniques.
eWPT
Web application penetration testing skills, from assessment method to exploiting common web flaws.
eWPTX
Advanced web application penetration testing skills, including complex attack techniques.
eMAPT
Mobile application penetration testing skills for Android and iOS applications.
BTL1
Defensive security skills across security operations, phishing analysis, forensics and incident response.
eCIR
Incident response skills, including investigating, containing and analysing security incidents.
CRTE
Red teaming skills focused on Windows environments and the tradecraft used against them.
CCT
EC-Council's Certified Cybersecurity Technician (CCT) validates foundational security, network, and defense skills.
Security+
CompTIA Security+ validates core skills in baseline cybersecurity, risk management, and threats.