Breach remediation and technical incident response.

The work that follows a security incident: triage to establish the entry point, scope and data touched, containment of continuing access, root-cause analysis, and the engineered fix to the weakness behind it. It ends with a re-test of the affected surface. Where personal information may be involved, we prepare the factual report for the Notifiable Data Breaches assessment.

Engineers who build and run production software in regulated industries, and who also run the firm's offensive testing practice. The person who traces your incident to root cause ships and attacks systems like yours, so the fix is engineered and shipped.

Call the 24/7 incident line on 1800 370 270. Engagement covers containment, root-cause analysis, remediation engineering and a re-test.

Yes. A suspected incident is a legitimate brief, and triage is the first phase of the engagement either way: establishing what happened, what was reached, and whether the compromise is still live. If the triage shows no incident, you get that finding in writing, along with whatever weaknesses the investigation surfaced.

Under the practices we apply to our own estate. Access is least-privilege, and containment actions are agreed with you before they are taken. Engagement material is encrypted in transit and at rest, few third parties touch it, and client data is hosted in Australian regions.

Yes, with a clear boundary. We establish the facts the Notifiable Data Breaches assessment rests on: what was accessed, who is affected and what remediation has been done, and write them up for the assessment and any notification. We do not give legal advice; your legal advisers make the legal judgement from that report.

A penetration test finds the holes before an attacker does. Breach remediation follows an incident, confirmed or suspected: containment, root cause and the engineering fix. It ends the way our offensive work does, with a re-test of the fixed surface.

Yes. Containment, root-cause analysis and remediation run against your systems wherever they are hosted, and scoping, containment coordination and the debrief run by phone, video and secure access.

Yes, with standing terms agreed before an incident: a named response lead, a response-time target set at a level we meet today, an annual readiness review and hourly rates agreed in advance. The incident response retainer sits beside the incident line.

By scope. Breach remediation runs as a fixed-scope engagement: triage and containment first, then remediation scoped against what triage found. The size of the affected surface, the state of the systems and any Notifiable Data Breaches support drive it. We do not publish prices, because a number without a scope misleads.