Speak to an incident response expert

Get in touch for assistance

1000 characters left
View our privacy policy


What is incident response?

Cyber security incident response is the approach an organisation takes to plan for, respond to, manage, and mitigate cyber security incidents. The ultimate goal of cyber incident response is to limit the damage and disruption of attacks and, where necessary, restore operations as quickly as possible.

Facing a cyber security breach demands swift and strategic action to safeguard your assets, operations, and reputation. Whether an incident is triggered by external forces or insiders, Kroll’s incident response specialists are on hand to assist promptly.

We respond to over 3,000 security events every year – managing incidents of all types, complexity and severity for organizations across a wide range of industries. You can count on Kroll’s unique frontline experience not only in a crisis, but also for proactive planning and mitigation strategies.


24/7 response - anytime, anywhere

Kroll is the world’s largest incident response company – responding to over 3,000 security events every year. Our goal is to quickly contain the compromise and smoothly guide you to recovery, to leave your team in the strongest position possible, with minimal business disruption and your reputation intact.

Incident response planning

What is an incident response plan?

An incident response plan (IRP) is a document which establishes a strategy to guide your organisation’s actions following a security incident.

Your incident response plan should clearly and comprehensively communicate the actions your organisation needs to complete after a cyber-attack. It should identify and set out tasks, procedures and responsibilities relating to each stage of the incident and include defined roles for specific activities.



What are the incident response steps?

While the nuances of an incident response plan will vary according to the nature and scale of your organisation, the process is generally based on the following key steps:

1. Preparation of systems and procedures

This is a critical step in the incident response planning process as it ensures that every aspect of the plan, from execution to resources, is approved and organised in advance. It involves the creation of key processes, the development of incident response drill scenarios and the assessment of your incident response plan. This stage also involves ensuring that your employees are properly prepared and trained for their incident response roles and responsibilities.

2. Identification of incidents

This is the stage of incident response where you identify whether your organisation has been breached and the level, if any, of the compromise of your systems. If a breach has occurred, it should be documented and reported as quickly as possible, as part of your formal breach notification process. Following your breach notification protocol will enable you to respond quickly and effectively to data breaches. You should also gather evidence in preparation for the next stage of the process and ensure that all the relevant people are prepared to take action. In the event of a breach, you should look to address key aspects such as who discovered it, its scope, its impact on operations and potential source.

3. Containment of attackers and incident activity

This is the incident response stage at which an organisation takes action to limit any additional damage from the incident, as well as prevent the destruction of evidence. It involves three key aspects:

– Short-term containment: The actions taken to limit any potential damage as quickly as possible.

– System back-up: The use of forensic software to capture a snapshot of the affected systems during the incident in order to preserve evidence and provide insights into the nature of the compromise.

– Long-term containment: Temporarily repairing the affected systems so that they can continue to be used, alongside rebuilding clean systems to ensure the removal of accounts or backdoors left by attackers and installing security patches.

4. Eradication of attackers and re-entry options

The eradication stage of incident response involves identifying the cause of the incident and removing malware or other threats introduced by the attacks, as well as restoring all the affected systems. Its core aim is to ensure the prevention of similar attacks in the future.

5. Recovery from incidents, including the restoration of systems

This stage involves restoring and returning affected systems and devices to their past status. As the phase in which organisations can begin operating again without creating the risks of further incidents, it involves checking whether systems have been patched, hardened and tested, if they are being restored from trustworthy back-ups and adopting tools to help prevent similar attacks.

6. Lessons learned and the application of feedback

The final stage of the incident response process takes place once the investigation is complete. All incident response team members should discuss learning points from the specific incident, alongside analysing and documenting everything about the breach. This is the opportunity to understand what was successful in an incident response plan and what was perhaps less effective.

Incident response services

Remote and on-site
incident response services

Whether you need help in an emergency or long-term support to enhance your organisation’s cyber incident response procedures, our experts are on hand 24/7 to provide assistance across the incident lifecycle.

Our cyber security incident response services include:


Cyber incident response service features

Get the help your team needs to quickly respond to incidents and minimise damage and disruption, but also support to formulate an effective cyber incident response plan for the future.

24/7 support and assistance

Should the worst happen, our experienced global team of cyber incident response experts are available to provide remote and on-site support around-the-clock.

Deep forensic investigations

By leveraging our computer forensic expertise and traditional cyber investigative techniques, we help ensure no digital evidence is overlooked and you have an accurate picture of any systems and data that have been compromised.

Detailed reporting and remediation guidance

Our expert team can help to clearly communicate the impact of incidents to internal stakeholders, partners, customers and regulators. To help you overcome incidents as quickly as possible, we provide remediation advice and support to help overcome them and avoid the risk of suffering additional damage and disruption.

Incident response planning and validation

Our cyber security incident response service and security assessment team can help you to build and implement a robust incident response plan and validate that plan's effectiveness with table-top exercises, such as Scenario-based Assessments and Red Team Operations.

Incident response FAQs

Frequently asked questions

What is incident response?

Incident response is the process of responding to, managing, and mitigating cyber security incidents. The purpose of incident response is to limit the damage and disruption of cyber-attacks and, where necessary, restore operations as quickly as possible.

What is a security incident?

A cyber incident or cyber security incident is an event that could lead to a compromise of confidentiality, integrity or availability. In practical terms, this could include an unauthorised data breach, unlawful data processing, the altering of data without consent, or a malicious attempt to disruption or denial of service.

How should you respond to a security incident?

When a security incident occurs, it is important not to let panic set in. Effective incident response requires a clear and robust incident response plan which outlines the actions key stakeholders need to take in a variety of scenarios.

What is an incident response plan?

An incident response plan is a set of actions and procedures that outlines an organisation’s response to security incidents. An incident response plan is designed to facilitate timely and effective incident mitigation by making it clear what steps should be taken and by whom.

What should an incident response plan include?

An incident response plan should include guidance for:

  • the assignment of responsibilities between responders
  • the outlining of technical protocols and escalation points
  • planning for resource gathering and documentation
  • establishment of communications and notification procedures
  • determining a review and testing schedule
What is a CSIRT?

A Computer Security Incident Response Team, or CSIRT, is a group of experts responsible for responding to security incidents. A CSIRT will include the security, IT and digital forensics staff responsible for other cyber security functions, but may also include PR, HR or legal personnel to help with breach reporting and notification requirements.

Why is an incident response plan important?

As the National Cyber Security Centre (NCSC) states:

“Incident response (IR) is complicated by two factors. Firstly, no two incidents are ever the same. Secondly, all responses require people, process and technical elements to work together in order to be successful.

Planning your incident response ahead of time is essential. This will be a major determining factor in the final outcome of any real world incident.”

Your incident response plan is your strategic roadmap outlining the steps your organisation should take in the event of different types of attacks. It ensures that you are able to take fast, decisive action to defend your organisation’s reputation and financial well-being.

Set out clearly and executed in a timely way, it can make the difference between responding effectively to an incident and experiencing significant organisational disruption. An incident response plan also communicates to stakeholders and regulators that your organisation is fully committed to addressing new and emerging threats.

What are the six steps of incident response?

The six steps of incident response are as follows:

  1. Preparation – incident response planning and process creation
  2. Identification – information gathering and incident analysis
  3. Containment – patching and damage limitation
  4. Eradication – threat removal and mitigation
  5. Recovery – returning systems to full operation
  6. Learnings – identification of improvements, further testing

Get immediate incident response assistance

Kroll EMEA hotline: +44 (0) 808 101 2168

Incident response support

The support to manage security incidents, whatever the scale

Building a cyber security incident response plan to deal with breaches as and when they arise is fraught with unknowns. Our unique and extensive frontline experience means we can help you make informed decisions at every stage. Kroll’s team of incident response and forensics experts have the expertise to investigate cyber incidents of all types – no matter the type, complexity or severity. We can deploy remote solutions quickly and/or be onsite within hours.

Common threats our cyber incident response services help to address:

  • Business Email Compromise
  • Advanced Persistent Threats
  • Malware, keyloggers and backdoors
  • Ransomware
  • Insider threats
  • Web application attacks
  • Targeted IP theft
  • Supply chain attacks

Incident response retainer

Flexible incident response retainers

To help your organisation better plan for and respond faster and more effectively to security incidents, Kroll’s incident response retainer provides elite digital forensics and incident response capabilities on-demand. Kroll’s services are flexible and configurable to the needs of your environment, regardless of the technologies you use.

With a transparent pricing model to ensure you get value for money, a Kroll cyber risk retainer provides peace of mind that security and forensics experts are on hand to support incident investigation, notification, containment and remediation.

Get more info

About us

Why choose Redscan and Kroll
for incident response

A Redscan employee shakes hands with a partner
  • Flexible, on-demand services to suit a wide range of security needs
  • Recognised by CREST and the PCI Council
  • A team of over 450 DFIR experts globally
  • >3,200 security incidents responded to every year

What Our Customers Say

4.8/5 - based on 52 Reviews
“The penetration testing that Redscan performed provided some very credible findings and outlined clear improvements that we were able to implement. The whole process raised the bar of our cyber security defences.”
Head of Cyber Security
Specialist Bank
"Redscan gave us the professional service and quick turnaround that we needed to meet our tight deadlines."
IT Manager
Financial Markets Association
“Redscan’s hands on approach identified security flaws that had previously been overlooked by other vendors.”  
Technical Operations Manager
Spread Betting Firm
"Should I need any security testing again in the future, Redscan would be my first port of call!"
Project Analyst/Developer
Life Insurance Provider
“We have been very impressed by the quality of Redscan’s engagement, communication and reporting. We will not hesitate to use them for any future testing requirements.”      
Information Security Officer
Investment Advisory
“Redscan has given us a third party stamp of approval for our IT security and the reassurance to know we are as secure as possible.”
IT Manager
Investment Advisory

Request assistance

Complete the form for a prompt response from our team.

Two Redscan team members analysing cyber security intelligence

1000 characters left
View our privacy policy


Discover our latest content and resources

From the blog
From the blog Case studies Latest news
13th May 2024
Mobile banking malware rises by 32%
Global mobile banking malware has grown by 32% in comparison with 2022, according to new research. The report also highlighted a surge in attacks targeting Android users.
8th May 2024
Insider threats soar by 14% annually 
New research has highlighted a significant rise in insider or employee fraud, with the most common reason being “dishonest action to obtain benefit by theft or deception”.
8th May 2024
Two-thirds of organisations fail to address AI risks
New research suggests that, despite the soaring use of AI in the workplace, just a third of organisations are successfully addressing its security, privacy and ethical risks.    
29th April 2024
Security leaders anticipate daily AI-driven attacks by year-end
According to new research, the majority of businesses are worried about AI-enabled cyber-threats, with 93% of security leaders anticipating daily attacks of this type by the end of 2024.  

Last updated on

Chief Research Officer

As Chief Research Officer in Kroll's Cyber Risk team, Mark is responsible for driving continuous improvements to our services. One of the UK’s leading security professionals, Mark is a lifetime CREST fellow.