We Find Out What Happened.
We contain the damage, investigate the cause, and give you findings that stand up in disciplinary hearings, court, and regulator inquiries.
What We Do
Incident Response
We contain the damage first, then investigate. Isolate affected systems, stop lateral movement, preserve evidence, and get you back online.
Digital Investigation
Full timeline reconstruction of who did what, how they got in, and what they took. Documented, provable facts for management, HR, or legal.
Malware Analysis
Reverse-engineered in an isolated sandbox. We identify the family, extract indicators of compromise, and sweep your environment for other infections.
Data Recovery
Deleted files, formatted drives, ransomware encryption. We image the original, work on a copy, and recover every byte we can.
Breach Investigation
We determine scope, identify what was taken, and produce a clear report with findings and timeline for management, legal, or insurers.
Employee Misconduct Investigation
Evidence gathered across workstations, email, cloud storage, USB history, and browser activity. Full timeline ready for disciplinary proceedings.
How We Handle Real Incidents
Sanitised timelines from real engagements. This is how we work when it matters most.
Ransomware at 3am
Employee stealing client data
How We Handle Evidence
Proper evidence handling means your findings are credible and defensible. Whether it's for a disciplinary hearing, an insurance claim, or handing to your legal team for further action.
The Toolkit
How We Investigate
Chain of custody. Court-admissible process. Every time.
Contain
Isolate affected systems and stop the bleeding. Prevent further damage, data loss, or evidence destruction. This happens first, before anything else.
Preserve
Forensically image all relevant evidence with full chain of custody. Write-blockers, hash verification, sealed originals. Nothing gets contaminated or lost.
Investigate
Timeline reconstruction and root cause analysis on forensic copies. We trace every step: initial access, lateral movement, data access, exfiltration. Every finding backed by evidence.
Report
Findings documented clearly with evidence, timestamps, and methodology. Clear enough for executives and HR. Detailed enough for your technical team or legal counsel. If the matter needs to go further, our documentation supports that handover.
Remediate
Close the vulnerability that was exploited. Harden the environment. Implement detection for the specific attack pattern. The same entry point never works twice.
Works Better Together
These services make sure it doesn't happen again.
Cybersecurity
We harden your environment so the same attack vector never works twice.
Compliance
Our forensics process produces documentation that satisfies ECTA and POPIA evidence requirements.
IT Operations
Proper monitoring and logging means the next incident gets detected in minutes, not months.
Something doesn't look right?
If you suspect a breach, data theft, or compromise, don't wait. Every hour matters. We handle all inquiries with complete discretion.