When our security operations console detects a real threat, a rehearsed response begins in minutes — not a ticket queue. This page walks through a genuine incident, step by step.
A real response, minute by minute
This is a realistic example of the most common incident we see: a stolen Microsoft 365 password used from overseas. The timeline below shows how detection turns into containment before real damage is done.
T+0 min
A Microsoft 365 sign-in from an impossible location triggers a Critical alert. The correlation engine attaches the user's recent email, device and VPN activity so the analyst sees the whole story in one screen.
T+2 min
A human analyst reviews the signal: the user signed in from Perth 40 minutes ago, and the new session is 11,000 km away with an unfamiliar device. This is a genuine account takeover attempt — not noise.
T+4 min
The approved playbook executes: all sessions revoked, password reset forced, the account blocked from new sign-ins, and any inbox rules the attacker created are stripped automatically.
T+6 min
Your nominated contact receives a call and a written summary: what happened, what we did, what we need from you (confirm the user wasn't travelling) and whether any business action is required.
T+20 min
The analyst hunts for lateral movement: did the attacker read email, send phishing from the mailbox, touch SharePoint, or create forwarding rules before containment? Every artefact is checked and logged.
T+45 min
The phishing email that stole the credentials is pulled from every mailbox, the sender domain is blocked, and the affected user is re-secured with fresh MFA registration before access is restored.
T+60 min
The user signs back in with a new password and re-registered MFA. Business impact: roughly one hour of inconvenience for one person, instead of days of recovery for the whole company.
T+24 hrs
You receive a plain-English report: timeline, evidence, actions taken, business impact and recommendations — such as tightening sign-in policies for the finance team.
Clear on the night
Incidents go wrong when nobody knows their role. Before anything ever happens, we agree exactly who acts, who decides and who communicates.
Rehearsed, not improvised
Each scenario has a pre-approved response plan, so the first minutes of an incident are spent containing it — not debating what to do.
Revoke sessions, reset credentials, re-register MFA, review mailbox rules and sent items.
Isolate the device from the network, disable the user account, protect backups, image the device for evidence.
Remove messages from every mailbox, block sender and links, warn recipients, reset any credentials entered.
Isolate the server, snapshot for forensics, rebuild from clean backup, rotate credentials that touched it.
Freeze affected mailboxes, audit forwarding rules, notify your contact before any payments change hands.
Remote lock and wipe, revoke tokens, confirm encryption was active, issue replacement hardware.
What businesses ask about the response side of security operations.
Be ready before it happens
Book a security review and we'll map your incident-response plan — contacts, playbooks and reporting included.
