Cynet Incident
Response Services
We resolve incidents fast
The unique combination of Cynet’s security experience together with proprietary technology enables fast and accurate incident response
Request a demo
The race against time to contain the incident
Whether its ransomware encrypting your data, info-stealing malware in your network or data breaches containing sensitive data, you need to receive the precise details of the attack to take the right course of action.
The clock is ticking and you need to contain the threat, scope the incident, assess the damage and remediate. It’s a race to get back to business as quickly as possible.
You need dedicated help that provides you with speedy answers and also ensures that your systems will be kept secure after the incident.
Incident Response that Combines Experience and Dedicated Technology
Cynet’s Incident Response (IR) service combines deep security analysis experience together with Cynet360, its world-class proprietary investigative and security technology.
The combination first and foremost means that you achieve the fastest and most accurate results.
Cynet’s proactive 24/7 security team acts as your extended team, leading any required analysis, ensuring that nothing is overlooked and generating the results you need.
Moreover, you can decide to keep Cyne360 post-resolution to protect your systems against future attacks.
Security Post-Resolution
At the end of the IR process, you have the option to keep Cynet360 to secure your systems against future breaches.
IR Setup That’s Fast and Scalable
No need to involve open source or manual tools. Our tech is easy to deploy, allowing for speed and scale across endpoints.
IR That’s Transparent
You get a dedicated IR project manager and point of contact, keeping you in touch at least daily and typically every few hours.
Best of Breed IR Tech
Cynet’s proprietary IR tech means that we look at alerts and information coming from endpoints, users and networks. This gives us the necessary visibility for IR and since everything is automated – to get to it quickly.
Reports That You Need
Ranging from executive summaries to detailed IoCs that can be exported to CSV for consumption by other systems or to manually update systems across the environment.
Experienced a Breach?
Get Immediate Assistance-
Triage
Human interaction is key and our first step sets the groundwork for engagement. Each company has a different background and needs so we first clearly define expectations, process stakeholders, known incident details and IT systems. Cynet then builds and shares the IR setup and game plan details. While this is the initial step, it follows us throughout the whole process, collaborating with your team, as well as any required third party, in order to reach an effective, transparent, and speedy resolution.
-
Deployment
To get to accurate results, the Cynet360 Autonomous Breach Detection Platform is deployed on your endpoints. This is a lightweight XDR agent that seamlessly integrates Next-Generation AV (NGAV), Endpoint Detection and Response (EDR), User Behavioral Analytics (UBA), Network Detection and Response (NDR) and Deception. Cynet deploys to 5000 endpoints in less than an hour.
-
Policy Creation
Cynet investigators create a customized policy within Cynet360, beyond the provided alerts and remediations on hosts, files, users and network. These customized detections and remediations are based on the information gathered in triage and data gathered in the initial deployment and deployed across the IT environment. For instance, the Cynet team may find it relevant to alert on a suspicious port to a malicious IP or on a malicious file based on its file properties.
-
Mitigations
Based on the Indicators of Attack (IOAs), Cynet provides recommendations and mitigations on the endpoint, as well as across the IT and security environment. For instance, Cynet may block traffic to/from a revealed malicious IP. Revealed malicious IPs can also be fed to other systems such as to your third party firewall. Other mitigations may include isolating the machine from the network or disabling a user.
-
Reporting
We provide you with all the reports you need, including an executive-level summary report with an overview of any malware analysis performed. Companies typically serve this report to their C-board and legal teams and some companies further share this report with their cyber-insurance company. Cynet provides additional, detailed technical reports that your security and IT teams can use to bolster your company’s protections.
Questions and Answers
Incident Response is the process to resolve and contain a cyber-security incident. Beyond just containing the incident, IR usually provides the attack story, scope of attack, damage assessment and even remediation.
An IR is necessary to get operations back to normal as quick as possible, and ensuring that systems are strengthened post-resolution. For regulatory, legal and even cyber insurance reasons, you might need to provide IR attestation with the incident details. It is also considered good business practice to provide your customers and business partners with visibility into the results of an IR process so that they know that you are serious and responsible in regards to securing their data.
A data security incident means that there was a gap, or multiple gaps, in the security of your organizational systems. The IR process includes investigating the security gaps that led to that incident and a good IR will provide recommendations for closing the gaps. Measures can include company-led anti-phishing awareness and training, updating system versions and even updating the company’s firewall to block rogue IPs.
- Triage. Based on initial data such as logs, understanding the affected systems, time the breach was first spotted, the IR experts understand where they need to focus their effort.
- Deployment where the IR experts deploy their IR tools.
- Policy creation where the analysts customize their tools based on attack tidbits (aka Indicators of Attack) to scope and contain the attack across the full environment.
- Recommendations and mitigations to close organizational security gaps as revealed by the IR analysis.
- Reporting on the attack to various stakeholders.
In a typical scenario, when a company initially spots a breach, they will begin the IR process. Large enterprises have built-in teams dedicated for this but in most cases, a breached company will call in a third party IR provider to lead the process. There are various reasons for this, including: the third party provider has dedicated skills and tools that are usually missing in-house, the internal team is too bogged down to dedicate resources beyond overseeing the process, or to get a third party opinion.
- What is your availability to dedicate yourself to the process?
- What’s the experience of the team working on our account?
- How does your IR process look like?
- What are your expected timelines for the process?
- Who are you assigning from your team as our designated point of contact?
- How do you keep up communication with my organization?
- At what frequency should I expect you to update my organization?
- What are the deliverables that you provide?
- What types of tools are you using?
- Do you provide mitigation assistance?
- Do you, or can you partner, with other security providers (vendors or service providers)?
- Can your technology be operated also by our team to prevent future breaches?
Cynet’s IR experts use Cynet360 – a dedicated investigative and security technology to provide fast and accurate answers. Since the technology combines multi-layer security solutions, the analysts automatically receive the details they need so that in a typical scenario, they resolve the incident within just a few days. Without Cynet360 an IR process could take weeks and even months.
Cynet works across all verticals, including banking, insurance, technology, retail, healthcare, education, automotive and publishing. Investigative incidents include ransomware, theft of IP, PII breaches and various types of malware. In particular, the Cynet IR team works with many companies that have small security teams – across all verticals – that cannot perform an internal IR process. In these cases, Cynet leads the investigative effort and continuously engages the client for full transparency of the process.