Incident response

Containment and remediation after an attack.

Remediation starts with establishing what happened and containing any continuing access. We work with your team on containment, fix the weakness behind the incident and verify the fix.

Call 1800 370 270 Talk to us about an incident

Still in the first hour?Isolating machines, keeping the evidence and calling your insurer come before the engagement.The first-hour steps

How it works

How we respond.

A fixed-scope engagement: investigation and containment first, then remediation and verification of the affected surface.

Triage in writing
The entry point, the scope and the data touched, and what is not yet known.
Containment
Containment actions agreed with you before they are taken.
Root cause and fix
The application, infrastructure or configuration weakness behind the incident, traced, fixed and deployed, with adjacent gaps hardened.
Verify and record
A re-test of the affected surface, and a factual record for your board, insurer or legal advisers.

Services

The work that applies.

Breach remediation
Fixed at the root and re-tested, wherever your systems are hosted.
Incident response
Investigation and containment, led on the call, with a written timeline.
Notifiable Data Breaches support
The technical record management and legal advisers need for an assessment.
Incident readiness
A response plan for your team, a tabletop exercise and a verified backup restore, before the next one.

On the record

Held to the standard we test against.

The controls we ask clients to run, we run on our own estate.

Essential Eight
Maturity Level 3, assessed September 2026.
SMB1001:2026 Gold
16 Jun 2026 to 17 Jun 2027
VerifySMB1001:2026 Gold, opens in a new tab
Insurance
Black Shard maintains professional indemnity, public liability, cyber and workers' compensation insurance. Certificates of currency are available on request.

Phishing-resistant multi-factor authentication on every account, with just-in-time administrative access.
Immutable off-site backups, restore-tested every day.

Before you call us.

Who is behind the incident line?

The practice that runs breach remediation. If the call goes to voicemail, leave your number and what you are seeing, and we call you back. The first conversation establishes what has happened and what has to be contained first.

Do we have to notify the OAIC?

If personal information is likely involved, the Notifiable Data Breaches scheme may apply, and the assessment it requires has to be prompt. We prepare the technical record for that assessment. We do not give legal advice.