Incident response and forensics
Cyber Incident Response and Forensics for Bay Area Businesses
If your business has been breached or hit by ransomware, we come on site, find out how the attackers got in, give you a written report and help patch the vulnerability.
Quick answer
If you have been breached, first disconnect the affected computers from the network without shutting them down (see the step-by-step guide). Then contact Fasthuma IT Solutions & MSP: during business hours (Monday–Friday, 9 AM–5 PM) call (510) 371-9468 and we’ll schedule an on-site visit as soon as possible; outside business hours, book a free phone consultation and we’ll get back to you as soon as possible. Rates: $1,000/hour (up to 500 devices) or $2,500/hour (more than 500 devices).
How to reach us
Getting help after a breach
Business hours
Monday–Friday, 9 AM–5 PM
Call us. We’ll schedule an on-site visit as soon as possible.
Evenings and weekends
Book a free phone consultation
Book the first available call online. We’ll get back to you as soon as possible.
Right now
Take your network offline
Follow our step-by-step guide while you wait. It is based on guidance from CISA.
What we do
From breach to patched
Incident response is about stopping the damage. Forensics is about finding out how it happened, so it doesn’t happen again.
1
We come on site
We schedule an on-site visit as soon as possible and work from your office, with your systems.
2
We find how they got in
Our forensics work traces the breach back to the way in: the account, device, open port or email that let the attackers through.
3
We present a written report
You get a written report of what happened, how the attackers got in and what we found.
4
We help patch the vulnerability
We help close the hole the attackers used, so the same way in cannot be used again.
5
Then we secure the rest
A full risk assessment, with its roadmap and timeline, shows what else needs fixing so your network is secured, not just patched.
Pricing
Incident response and forensics rates
Incident response and forensics use the same on-site hourly rate as our risk assessments. The rate depends on the size of your network.
Small and mid-sized businesses
Up to 500 devices
$1,000 per hour, on site
Enterprise
More than 500 devices
$2,500 per hour, on site
- Roadmap and timeline included. Every risk assessment comes with a phased roadmap and timeline, delivered after the on-site visit, at no extra charge.
- Fixes and refreshes are quoted. Network security upgrades and equipment refreshes are quoted per project, from the roadmap.
- Ongoing monitoring is a monthly managed service. See the Flame, Blaze and Inferno plans on msp.fasthuma.com.
A device is anything we manage on your network: computers, laptops, servers, phones, printers and network equipment. Rates are subject to change; your rate is confirmed before any work starts.
Report the incident
CISA, the U.S. Cybersecurity and Infrastructure Security Agency, suggests reporting incidents and considering a request for help from federal agencies:
- CISA: CISA: Report a cyber incident, or call (888) 282-0870 (24/7).
- FBI: file a complaint with the FBI Internet Crime Complaint Center (IC3) or contact your local FBI field office.
If you have cyber insurance, check your policy for how and when to notify your insurer. See cyber insurance and compliance.
FAQ
Incident response questions
Should I turn off computers that have been hacked?
Not if you can avoid it. CISA advises disconnecting affected devices from the network (unplug the network cable, turn off Wi-Fi) and powering them down only if you cannot disconnect them, because shutting down can destroy evidence held in memory. See our step-by-step guide.
What does cyber forensics involve?
Forensics is the investigation of how a breach happened. We come on site, trace how the attackers got in, and present our findings in a written report. Then we help patch the vulnerability they used.
Do you respond 24/7?
No. Our hours are Monday–Friday, 9 AM–5 PM. During those hours, call (510) 371-9468 and we’ll schedule an on-site visit as soon as possible. Outside business hours, book a free phone consultation and we’ll get back to you as soon as possible.
How much does incident response cost?
$1,000 per hour on site for businesses with up to 500 devices, and $2,500 per hour for businesses with more than 500 devices.
Should I report a cyber attack?
CISA suggests reporting to CISA, your local FBI field office or the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov. CISA’s 24/7 line is (888) 282-0870.
Can I restore from backup straight away?
Wait. CISA advises not rebuilding from backups until the malware that got in has been identified, otherwise you can be reinfected. We help you work out when it is safe to restore.
Breached? Start here
Take your network offline first. Then call (510) 371-9468 during business hours, or book a free phone consultation any time.