Should we shut systems down immediately?

Not always — powering off can destroy volatile evidence and worsen recovery. Isolate from the network first and take advice before rebuilding, so the investigation remains possible.

Do you handle regulatory notification?

We provide the factual findings that notification decisions depend on and support your response. Legal determinations remain with your counsel, and we say so plainly.

Can you help before an incident happens?

Yes, and it makes a material difference. Agreeing contacts, access and evidence-handling in advance means we can act within hours rather than spending the first day working out who can authorise what.

How does a incident response & digital forensics engagement start?

With a short discovery conversation and a written view of scope, risk and the decisions to be made. That view is useful to you whether or not the work continues.

How is a incident response & digital forensics engagement priced?

Scope and, where relevant, rules of engagement are agreed in writing before any work begins, and the engagement is a fixed fee for that scope or phased with a cost envelope per phase — so you know the cost and the boundaries up front. Larger pieces of work are broken into phases with findings delivered early rather than a single invoice at the end.

Cybersecurity · Secure

Incident Response & Digital Forensics

We help you contain an active incident, preserve the evidence properly, and establish what actually occurred from that evidence rather than from guesswork. We analyse endpoints, servers, cloud and identity logs to reconstruct how access was gained, what was done and what was genuinely affected, stating our confidence honestly. We support the recovery and the factual basis for any notification decisions, while leaving legal determinations to your counsel. Throughout, we work to keep the investigation possible, because the wrong first move can destroy the evidence you later need.

In short

Incident response and digital forensics contain an active security incident and establish what happened, from evidence rather than assumption. The work limits the damage while preserving the material needed to understand entry point, scope and impact defensibly.

Start a conversation

What we do

The work inside incident response & digital forensics.

Containment and stabilisation

We limit the spread of the incident while preserving the evidence needed to understand it. Acting too hastily, such as powering systems off, can destroy volatile evidence and make recovery harder. We isolate affected systems in a way that stops the bleeding without blinding the investigation.

Forensic analysis

We analyse endpoints, servers, cloud and identity logs to establish how access was gained, what actions were taken and in what order. This reconstructs a defensible timeline rather than a plausible story. The analysis is documented with the evidence that supports each conclusion.

Root cause and impact

We determine the entry point and establish which data and systems were genuinely affected, as distinct from merely accessible. Where the evidence is incomplete we say so plainly rather than overstate certainty. An honest impact assessment is what notification and recovery decisions should rest on.

Recovery and lessons learned

We support safe restoration so that recovery does not simply reinstate the original weakness. We then turn the findings into specific control changes and assign them owners so they actually stick. The aim is that the same incident cannot recur the same way.

What you receive

Deliverables, in writing.

Documented output your teams keep and can act on without us in the room.

Containment actions log
Forensic timeline with supporting evidence
Root cause and impact assessment
Recovery and improvement plan

When this work helps

You may be facing this.

Ransomware, business email compromise or data exfiltration is suspected
Systems are behaving oddly and nobody can explain why
An incident was handled but the cause was never established

How an engagement runs

Discover, assess, design, deliver.

01
Discover
Understand what matters most, the obligations in play, and what the organisation is genuinely trying to protect. We agree scope and rules of engagement in writing here, so testing is bounded and authorised before it begins.
02
Assess
Test and review the systems in scope, and establish real exposure rather than theoretical risk. We gather evidence for every finding, so severity reflects what we demonstrated rather than what is merely conceivable.
03
Design
Prioritise remediation, control improvements, and architecture changes against risk and effort. We sequence the work so the exposures that matter most are closed first, within what the team can realistically do.
04
Deliver
Support remediation, retest what was fixed, and help the practice hold as the environment changes. We confirm fixes actually closed the issue, rather than taking remediation on trust.

Where we work

Delhi, India — and wherever the work is.

Fidova delivers cybersecurity consulting and technical assurance from Delhi, India, and works with clients internationally; testing and review are performed remotely against your environments, with on-site work arranged when scope requires it.

Engagements run in English, are scheduled around your time zone, and can be delivered remotely end to end, with on-site time planned where a phase genuinely benefits from being in the room.

Related services

Often needed alongside this.

Threat Intelligence

Threat intelligence tells you which threats are actually relevant to your sector, technology and exposure, and what to do about them. It turns the general noise about cyber threats into an assessment specific enough to drive control, detection and awareness decisions.

Malware Analysis & Reverse Engineering

Malware analysis and reverse engineering establish what a malicious sample does, what it touched and how to detect it. The work produces the behaviour, indicators and capability evidence that an incident decision can rest on, rather than relying on a vendor label alone.

Active Directory Security Assessment

Active Directory security assessment finds the privilege escalation and lateral movement paths that lead to domain compromise. In most incidents these paths are the route from one compromised laptop to the entire estate, which is why they warrant specific, focused attention.

All cybersecurity services

Questions