What it is
Many organisations are hit a second time because the first weakness was never fixed, or because their backups stayed reachable from the network.
We use the investigation’s findings to close that gap, and we redesign backups so they stay isolated, immutable and tested.
Signs you need this
- You have just recovered from an incident
- Backups share a network or accounts with production systems
- Restores have never been tested
- Remote access or admin accounts lack multi-factor authentication
What we do
Fix the cause
Patch, reconfigure or remove whatever the attackers used to get in.
Tighten access
Review admin rights, enforce multi-factor authentication and remove dormant accounts.
Rebuild backups
Set up isolated, immutable backups and run a full test restore with you.
What you get
- The exploited gap closed and verified
- A backup design attackers cannot delete
- A tested restore procedure
- A prioritised list of further improvements
What we need from you
- The investigation findings, or time to run one
- Access to your systems and backup platform
- A contact in your IT team
Questions
Can you do this before anything has happened?
Yes. Many clients ask us to review their backups and access before an incident.
Do you replace our IT provider?
No. We work alongside your team or provider and hand over everything we change.