Business email compromise
A fraudulent payment request is sent from a real executive mailbox. We contain the account, identify what the attacker accessed and help you notify affected parties.
Incident response & recovery
Be ready before the worst day.
Plan for incidents in advance, then get structured support to investigate, contain and recover when something goes wrong.
The business problem
An incident is the wrong time to write the plan.
When an account is compromised or systems are encrypted, every hour matters. Organizations without a plan lose time deciding who to call, what to shut down and what to tell clients, insurers and staff.
Recovery without investigation is also risky. Restoring systems before you understand how an attacker got in can lead to a second incident.
What Simba Cyber does
Readiness first. Coordinated response when needed.
We help you prepare with a practical plan and exercises, then support investigation, containment and recovery when an incident occurs. Clients with ongoing services receive incident support as defined in their agreement.
- Incident response plans and playbooks
- Tabletop exercises for leadership and IT
- Structured investigation and containment support
- Recovery coordination and lessons learned
Scope & capabilities
What the service includes
Capabilities are confirmed for your environment during scoping and documented in your agreement.
01
Prepare
- Incident readiness assessments
- Response plans and role assignments
- Playbooks for common scenarios
- Tabletop exercises
02
Respond
- Initial triage and scope assessment
- Investigation support across Microsoft 365 and endpoints
- Containment planning and execution
- Evidence preservation guidance
03
Recover
- Recovery coordination and sequencing
- Credential and access reset planning
- Coordination with insurers, counsel and IT providers
- Business communication support
04
Improve
- Post-incident reviews
- Lessons-learned reports
- Control improvement plans
- Plan and playbook updates
Common use cases
How this works in practice
Representative scenarios that show how the service responds. They are illustrations, not client case studies.
Ransomware on a file server
Files on a shared server are encrypted. We help isolate affected systems, preserve evidence, confirm clean backups and plan a staged recovery.
An annual readiness exercise
Leadership walks through a realistic scenario. Gaps in decision-making and contacts are recorded and fixed in the plan.
Business outcomes
What you can expect
- Faster, calmer decisions during an incident
- Clear roles for leadership, IT and external parties
- Evidence preserved for insurers and counsel
- Fewer repeat incidents through documented lessons learned
Delivery methodology
How we deliver
- 01
Plan
Write or update your incident response plan and contact list.
- 02
Exercise
Test the plan through tabletop scenarios and improve it.
- 03
Respond
Triage, investigate and contain incidents within agreed scope.
- 04
Learn
Review what happened and implement improvements.
Related Microsoft technologies
Built on the platforms you already use
Scope and licensing considerations
Incident support for existing clients follows the escalation contacts and terms in their agreement.
For organizations without an existing agreement, emergency support depends on availability and scope. Your cyber insurer may require you to use a specific response firm, so check your policy first.
We support investigation and recovery. Formal digital forensics for litigation, and legal or regulatory notification advice, may require specialist firms and legal counsel.
Questions
Incident Response & Recovery: common questions
We have an active incident. What should we do?
Existing clients should use the incident contacts provided during onboarding. If you are not a client, contact your cyber insurer first, as many policies require approved response providers. Then contact us by phone. The website form is not monitored as an emergency channel.
Do you guarantee a response time?
Response commitments are defined in client agreements. We do not publish general response times because they depend on scope and the services in place.
Will you work with our insurer and lawyer?
Yes. Coordination with insurers, breach counsel and other providers is a normal part of incident response.
Next step
Build your incident plan before you need it.
Tell us about your organization and priorities. We will recommend a practical scope and explain what it would include.