The first hours after an incident matter most.
Service
Cyber incident analysis
When accounts or systems are compromised, we establish what happened, what was accessed and how to contain it.
Overview
How cyber incident analysis works.
A compromised email account, a suspicious login, an unexpected payment from your systems — the first hours after a cyber incident are confusing, and decisions made then matter.
GFIR helps you establish the facts: how the attacker got in, what they accessed, what they did and whether they still have access. We review logs, account activity and devices to build a reliable timeline of the incident.
You receive practical containment recommendations and a clear incident report for your insurer, regulator, lawyer or board.
Signs you may need this
- Unknown logins, password resets or new email forwarding rules
- Customers or suppliers received emails you didn't send
- Files, settings or permissions changed unexpectedly
- A payment left your accounts that no one authorised
- Your insurer or regulator needs an incident report
Logs are collected and turned into a reliable timeline.
We establish exactly what the attacker reached.
How it works
Our approach, step by step.
- 01
Triage
We assess the situation quickly and advise on immediate steps to limit damage and preserve evidence.
- 02
Collect logs
Sign-in, email, cloud and device logs are gathered before they expire or are overwritten.
- 03
Build the timeline
We reconstruct how access was gained, what was touched and when.
- 04
Report and recommend
A clear report with findings and practical containment and prevention steps.
Who it's for
- Small and mid-sized businesses
- Professionals with compromised accounts
What's included
- 01Log and access review
- 02Compromise timeline
- 03Containment recommendations
- 04Incident report
Realistic expectations
Scope depends on available logs. Missing logs limit what can be proven.Before you contact us
What to prepare.
Don't worry if you don't have everything — send what you can and we'll guide you through the rest.
- ✓Admin access (or contact) for affected systems
- ✓Dates and times you first noticed something wrong
- ✓Any alerts, suspicious emails or messages received
- ✓Details of any payments or data affected
- !Never share passwords, private keys or seed phrases — with anyone, including us.
Questions
About cyber incident analysis
Should we shut everything down?+
Not necessarily — shutting down can destroy evidence. Contact us first if you can; we'll advise on the safest immediate steps.
How far back can you see?+
That depends on your systems' log retention. Many cloud services keep only 30–90 days by default, so speed matters.
Do you replace our IT provider?+
No. We work alongside your IT team or provider, focusing on investigation and evidence rather than day-to-day support.
Will the report work for our insurer?+
Our reports are written to be shared with insurers, regulators and lawyers, with clear findings and supporting evidence.
Guides
Read before you act.
First 24 hours after a business email breach: a checklist
Guide · Cyber incident analysis
Why log retention matters before an incident
Guide · Cyber incident analysis
Multi-factor authentication: what actually stops attackers
Guide · Cyber incident analysis
Related services
Cryptocurrency tracing
We follow stolen or misdirected digital assets across wallets, chains and bridges, and identify where funds reached exchanges or regulated services.
Online fraud investigation
Investment platforms, impersonation and payment fraud — we reconstruct what happened and who was behind each step.
Digital forensics
Forensically sound collection and analysis of phones, computers, email and cloud accounts, preserving evidence so it can be relied upon later.
Confidential case review
Confidential case review
Tell us what happened.
Your message is read by an investigator, not a sales team. We'll reply with an honest assessment of what can be done.
Have a question first? Read our FAQ →
Prefer email? info@gfirglobal.com