Incident Response.
Bring structure to uncertainty. Contain the incident and move towards recovery.
Discuss your requirementsA focused engagement.
When a security incident disrupts your business, clear priorities matter. We help establish the facts, coordinate containment, investigate the impact and support an evidence-led recovery across agreed IT, identity and cloud environments.
When this service helps
- Suspected ransomware or unauthorised access
- Business email compromise and account takeover
- Data exposure or malicious activity in supported environments
Clear boundaries. No surprises.
Acceptance, availability, response windows and supported systems are confirmed at engagement. This website is not a monitored emergency hotline. Recovery outcomes cannot be guaranteed.
From suspicious activity to patient zero in three days.
A major Hong Kong hospitality organisation discovered unfamiliar services and unexpected desktop files on a computer. An analyst-led investigation, accelerated by AI-assisted triage, traced the activity to a software supply-chain compromise within three days.
- Industry
- Hospitality
- Client location
- Hong Kong
- Incident
- Supply-chain compromise
- Investigation completed
- Within three days
Proprietary AI workflow. Analyst-led investigation.
The response team provided the client's IT staff with a collection tool to gather logs and forensic artifacts. After data cleaning and parsing, an AI agent operating within our proprietary investigation workflow surfaced suspicious events and prioritised leads for deeper analyst review. Investigators reconstructed host activity and built a timeline, then reviewed findings with the client to distinguish legitimate operations from unauthorised activity.
Follow the evidence back to the source.
Each round of findings directed the next targeted collection. Across three to four iterations, the team identified patient zero, the earliest compromised system found in the investigation. The evidence traced initial access to a compromised package downloaded by an employee while using an AI tool. The attacker gained access to a cloud server, entered the organisation's environment and moved laterally across systems.
The investigation workflow
- 01
Collect, clean and parse
Client IT collects logs and artifacts using the supplied tool. Analysts prepare the data for investigation.
- 02
AI agent-led triage
An AI agent executes our proprietary investigation workflow to surface suspicious events and prioritise leads for expert validation.
- 03
Investigate and reconstruct
Analysts validate the leads, examine host activity and reconstruct an evidence-based timeline.
- 04
Brief, validate and repeat
Review findings with the client, rule out authorised activity and scope the next collection.
Repeat with targeted evidence collection: three to four investigative rounds traced the activity back to patient zero.
The reconstructed attack path
- Software supply chain
Compromised package
Downloaded while using an AI tool
- Cloud infrastructure
Cloud server compromised
Attacker gains access to a server
- Corporate environment
Entry into the environment
Access extends into company systems
- Internal systems
Lateral movement
Attacker moves across hosts
Move fast. Validate deeply. Find the source.
Within three days, the investigation connected the initial warning signs to the earliest identified compromised system and the supply-chain entry point. AI accelerated triage; analyst validation and close collaboration with client IT turned those leads into an evidence-based account of the intrusion.
An anonymised example from a team member's prior professional experience, not a Zyber Blade client engagement. Identifying details have been omitted. The three-day timeframe applies to this investigation, not to remediation or full recovery, and is not a guaranteed turnaround for other engagements.
Tracing a ransomware attack across borders.
A Hong Kong-based manufacturer experienced a ransomware incident that encrypted employee endpoints, servers and VMware ESXi infrastructure.
- Industry
- Manufacturing
- Client location
- Hong Kong
- Incident
- Ransomware
- Investigation focus
- Cross-border intrusion
From disruption to evidence.
The response team deployed on site to establish the scope of impact and preserve evidence. Selected systems were forensically imaged, while logs and configuration data were collected from firewalls, ESXi hosts, data-centre systems and web-facing services. Remote-access exposure was also reviewed.
The finding that connected the case.
Correlating network telemetry with host and Windows event data revealed suspicious scanning activity. The investigation traced the intrusion to a malware-infected sales workstation in the United States. The attacker leveraged the workstation's VPN access to enter the organisation's Hong Kong network, move laterally across internal hosts and deploy ransomware.
The investigation workflow
- 01
Establish the scope
Attend on site and identify encrypted and unaffected systems.
- 02
Preserve the evidence
Acquire forensic images of selected systems and collect logs and configuration data.
- 03
Connect the signals
Correlate network and host evidence, review remote-access exposure and investigate suspicious scanning activity.
- 04
Trace the intrusion
Link the activity to a US-based sales workstation and reconstruct the route into the Hong Kong network.
The reconstructed attack path
- United States
Compromised workstation
Malware-infected sales endpoint
- Remote access
VPN entry
Access into the Hong Kong network
- Hong Kong
Lateral movement
Movement across internal hosts
- Internal environment
Ransomware deployment
Endpoints, servers and ESXi affected
Clarity beyond the encrypted systems.
The investigation connected the affected Hong Kong environment to an overseas compromised endpoint, establishing an evidence-based attack path to inform containment, remediation and recovery decisions.
An anonymised example from a team member's prior professional experience, not a Zyber Blade client engagement. Identifying details have been omitted.