Incident response & cyber preparedness · IT · Cloud · AI · OT · IoT
IONSEC is a boutique incident response and digital forensics firm. The people who publish our state-sponsored actor research pick up your incident, and they unravel the whole chain: how the attacker got in, what they touched, and what would let them back.
Every system in orbit around one case: IT, cloud, AI, OT and IoT worked as a single chain rather than as separate investigations.
4 hours
Assured response time from first contact, 24/7.
21
Research write-ups, case studies and tool releases, published ungated.
7
Open-source DFIR tools published and maintained.
Trusted across defence, energy, finance, critical infrastructure and national cyber bodies
Anatomy of an incident
The night of the incident is the part everybody remembers. The work that decides how it ends happens on either side of it.
Act one · Months before
A log source that was never enabled. An OT segment the EDR does not reach. An escalation path routed to someone who left last year. None of it announces itself, and all of it surfaces at the worst possible hour.
Cyber Preparedness — find it on a quiet Tuesday, for a fraction of the cost.
Act two · The night of
First contact starts the clock. Remote memory capture begins immediately, because the evidence that answers the hardest questions is the evidence that disappears first. Containment is planned against the actor, not the alert.
Emergency IR — assured four-hour response, 24/7, remote acquisition from minute one.
Act three · The months after
Most incidents are closed at the symptom and recur a month later. We stay through eradication, verify the access path is genuinely shut, and feed what we learned back into your detections.
T3aaS — senior escalation and continuous hunting, so the same class of alert closes itself next time.
The people who publish our state-sponsored actor research are the people who pick up your incident. There is no call centre in front of them, and every finding and tool is published ungated.
Most organizations discover the gaps in their readiness during an incident, when the cost of finding them is highest. We front-load that work, and we are still there at 3am when it matters.
Readiness engagement
Most organizations discover the gaps in their readiness during an incident, when the cost of finding them is highest. Cyber Preparedness front-loads that work: we map what you actually have across IT, cloud, AI, OT and IoT, establish the visibility and access an investigation depends on, and rehearse the response until it is routine rather than improvised.
More on this → Cyber PreparednessOngoing retainer
Tier 1 and Tier 2 handle volume; the hard cases escalate. T3aaS gives you that senior escalation tier on demand: the reverse engineers, threat hunters and forensic analysts who resolve the alerts nobody else can close, without carrying the headcount full time.
More on this → T3aaS — Tier 3 as a Service24/7 emergency response
Neutralizing what you can see is not containment. Our incident response engagements run the full chain (detect, contain, eradicate, recover) and do not close until we understand how the actor got in, what they touched, and what would let them back. Assured response within four hours of first contact.
More on this → Emergency Incident ResponseWe will tell you honestly which of these you need first. If the answer is none of them, we will say that too.
Assured response within four hours of first contact.
