05 Service
What happens when prevention fails, planned in advance so the response is never improvised under pressure.
01 Overview
Nearly every organization has an incident plan. Very few have run it. This work establishes whether yours could actually be executed, and how much of it would be improvised on the day.
The gap between those two states is where incidents become expensive: not in the intrusion, which is usually over quickly, but in the hours afterwards spent deciding who is allowed to make decisions.
02 Engagements
If you have never exercised a plan, start with a tabletop. It reliably finds more than a document review does, because it surfaces the disagreements a document cannot.
Does the plan survive contact
Reading the plan against how your organization actually works. Most plans fail on the same things: they name people who have left, assume systems that will be unavailable during the incident, and skip the decisions that turn out to be hardest: who can authorize taking production offline, and who speaks to customers.
Rehearsal, with the people who would be there
A scenario walked through in real time with the group who would actually run it, including the executives. What the exercise produces is the arguments that surface, the decision nobody realized they owned, and the assumption two teams held differently.
The scenario most likely to happen
Working backwards from the outcome that would hurt most: what an attacker would need to reach in your environment to make encryption effective, and whether you could restore without paying. Covers detection, containment, backup integrity, and the decision nobody wants to make in the moment, which is whether to pay.
Whether recovery is real
The question is whether your backups restore. We look at whether they are reachable from a compromised network, whether the credentials that manage them are in the same identity domain as everything else, and whether anyone has recently restored from them at the scale an incident would demand.
Point-in-time, are they already here
A structured look for evidence of intrusion that has already happened: persistence, anomalous identity activity, unexpected outbound traffic, artifacts of known tooling.
03 Process
We facilitate these sessions, and the work depends on the right people being in the room.
Before anything else, which systems and data would actually stop the business. This sounds obvious and is usually contested: the list operations gives and the list finance gives are rarely the same, and resolving that is half the work.
The plan, the runbooks, the contact lists, the contracts with anyone you would call. We read them the way an attacker's timeline would, looking for the steps that assume something which will not be true at 3am on a Sunday.
A scenario built from how your environment is actually laid out, run in real time, with the decisions actually made.
Every point where the exercise stalled, every decision that took too long, every assumption that turned out to be held by one person. That list is the actual output, and it is usually uncomfortable reading. The parts that failed then get rewritten with the people who own them.
Six to twelve months later, with a different scenario. The first exercise tells you where you stand. The second tells you whether anything changed.
04 Deliverable
05 Questions
No. We do readiness, exercises, and point-in-time compromise assessment.
Contact us if you want a second pair of eyes on triage and scoping, or help working out what the incident responders are telling you.
The people who would actually be in the room: technical responders, whoever can authorize taking systems offline, legal, communications, and at least one executive.
The session itself is usually half a day. Preparation takes longer, because a scenario built from your actual architecture is worth considerably more than a generic one, and that requires understanding your environment first.
No. It is a point-in-time look for evidence of intrusion that has already happened.
06 Contact
TowerVector will assist you in taking your security strategy to the next level. Please feel free to contact us: