In an incident right now?
Shutting a machine down wipes volatile memory — and with it part of the evidence needed to understand what happened. Disconnect from the network if you can, delete nothing, and call the line. Customer or not.
IRT
The IRT is TripleCyber’s immediate response team. It steps into a live incident — logically and physically — stops the attack, investigates it through to full identification of the attack vector, and returns the organisation to a safe working environment.
The team also stays with long-running incidents, and is experienced in negotiation events with attackers.
The first hour
A senior analyst comes on the line, establishes what was seen, and says immediately what to do and what not to do so the evidence survives.
Isolating and quarantining affected assets, revoking sessions, resetting credentials and cutting the attacker’s command channels.
Memory, logs and disk images collected; the attack path reconstructed from entry to last action.
Services restored from clean backup, in an order set by business criticality rather than at random.
A full report for the customer, the regulator and the insurer — and the list of controls that stops the same incident recurring.
Incident recording
The recording shows the incident screen as the team sees it: the timeline, the affected assets, the indicators and the containment actions taken.
Incident IR-2026-0412. Identifying data was replaced; the timings are real.
INCIDENT REPLAY · IR-2026-0412
Every line here was written by a system or by an analyst, in real time. This is what goes into the report at the end.
A real incident at one of our customers, published with their consent. Identifying details were changed; the timings were not.
The report
Not a three-sentence summary. A full report: an executive summary in language management can act on, an exact timeline, indicators of compromise you can feed into your own systems, the techniques mapped to MITRE ATT&CK, and a severity-ranked list of recommendations.
It is also the document that answers the regulator and the insurer.
Retainer
Case files
What decides an incident in the end is not how fast it was detected, but how fast it was stopped.
Local authority
Law firm
Industrial manufacturer
Yes. The line takes emergency calls from organisations that are not customers. We start with a short diagnostic call and step in from there.
No. It makes things harder, but a lot of evidence survives on disk, in logs and in perimeter systems. Tell us exactly what you shut down, and when.
That is the organisation’s decision, not ours, and it has legal aspects too. We are experienced in negotiation events and will help you weigh it — including how much their decryption key is actually worth.
Retainer customers have a guaranteed response time in the agreement. For a new call, an analyst is on the line within minutes, and the scope of engagement is decided on that call.
It depends on the type of data and the sector. We provide the factual basis the reporting decision rests on, and the report that is actually filed.
Emergency line · 24/7/365
Shutting a machine down wipes volatile memory — and part of the evidence with it. Disconnect from the network if you can, delete nothing, and call. A senior analyst is on the line within 15 minutes, customer or not.
08-691-4954