Do I need a retainer to engage you?

No. We accept emergency engagements. A retainer guarantees response service-level agreements (SLAs) and a known commercial framework, which is why most regulated organisations carry one - but it isn't a prerequisite.

What does an IR retainer include?

Guaranteed response SLA, pre-approved commercials, an annual readiness check (runbooks, tabletop), and prepaid hours that can be used either for incidents or proactive readiness work if not consumed.

Do you negotiate with ransomware actors?

We can coordinate with specialist negotiators where it's appropriate and lawful. Our default position is to recover without paying - payment is a last resort and a board-level decision.

Will you work with our cyber insurer?

Yes. We work with major Australian and global cyber insurers and their panel counsel, and can be added to panels on request.

How do you handle Notifiable Data Breach obligations?

We support assessment of notifiability under the Privacy Act, draft notifications, and coordinate with the OAIC. Final notification calls remain with you and your legal counsel.

Do you do tabletop exercises and IR readiness?

Yes. Retainer customers get an annual exercise included. Standalone tabletop and runbook engagements are also available.

Where are responders based?

All AUCyber IR responders are based in Australia. On-site response can be coordinated nationwide where helpful.

INCIDENT RESPONSE

When something goes wrong, we're already moving.

Australian incident response from a team that does this every week. On the call within minutes - containment, eradication, recovery, and a board-ready report at the end.

Engage IR now

<60min

Engagement to first responder

AU IR

Onshore DFIR team

24/7

On call

Retainer

Or pay-as-you-go

WHEN THE WORST HAPPENS

The first hour decides how bad this gets.

Whether it's ransomware, business email compromise (BEC), a stolen mailbox or a confirmed intrusion - the next decisions you make matter more than the controls that failed. You need experienced humans on the call now.

Confused command

Without a clear IR lead, the call turns into ten people guessing and nothing actually getting done.

Containment delayed

Every hour an attacker stays in your environment, the harder eradication and recovery get.

Missing telemetry

Without the right logs, Endpoint Detection and Response (EDR), identity and network signal, investigations stall before they start.

Regulatory clock ticking

Notifiable Data Breach (NDB), contractual notification clauses, insurance, regulators - all want defensible answers fast.

WHAT YOU GET

An Australian IR team that runs the incident, not just observes it

AUCyber's IR practice takes incident command, runs containment and eradication, recovers your environment, and writes the report your board, your insurer and your regulators need.

Rapid engagement

First responder on the bridge within 60 minutes of engagement, day or night.

Containment & eradication

Isolate hosts, kill persistence, lock identities, sever attacker comms - fast, decisive, documented.

Forensic investigation

DFIR collection and analysis to scope the breach, identify root cause and confirm full eradication.

Recovery & rebuild

Hands-on restoration of identity, endpoints, data and services - with hardening baked into the rebuild.

Post-incident reporting

Clear, defensible reports for your board, insurer, regulators and customers. Lessons learned, action plan included.

Regulator & legal liaison

Coordination with Notifiable Data Breach obligations, Office of the Australian Information Commissioner (OAIC), Australian Signals Directorate (ASD)/Australian Cyber Security Centre (ACSC) reporting and legal counsel.

WHEN TO CALL

If any of these are happening, call us

Common engagements range from active ransomware to suspected insider misuse. If in doubt, call.

Critical

Active ransomware

Encryption underway or completed. We contain, scope, recover from backups where viable, and coordinate negotiation if appropriate.

Finance fraud

Business email compromise

Hijacked mailboxes, malicious inbox rules, attempted wire fraud - investigated, contained and remediated.

Breach

Confirmed intrusion

EDR, Security Information and Event Management (SIEM) or third-party notification of a real intruder. We scope dwell time, find the persistence and close it down.

Insider risk

Insider or data exfiltration

Sensitive movement of data by current or former staff - investigated forensically and reported defensibly.

HOW WE WORK

What an IR engagement looks like

Predictable structure, even in unpredictable circumstances.

Engagement model

Hotline: 1800 282 568 - 24/7 IR engagement
First responder: On the bridge within 60 minutes (target)
Models: Pay-as-you-go, IR retainer, or bundled with managed services
Coverage: Australia-wide; remote-first with on-site available

Phases

1. Triage: Confirm severity, set scope, stand up incident command
2. Contain: Isolate, sever attacker access, freeze evidence
3. Eradicate: Remove persistence, rotate credentials, harden config
4. Recover: Restore services, rebuild trust in identity and endpoints
5. Report: Findings, root cause, timeline, regulator-grade evidence

Tooling we bring

EDR: SentinelOne (or operate against your existing EDR)
SIEM: SentinelOne AI SIEM for live correlation
Forensics: Industry-standard DFIR collection and analysis tooling
Comms: Secure bridge, encrypted file exchange, structured reporting

Reporting & evidence

Reports: Executive summary, technical timeline, IOC list, lessons learned
Regulator support: OAIC NDB notifications, ASD/ACSC notifications
Insurance: Coordination with cyber insurers and panel counsel
Residency: Australian responders, Australian evidence handling

WHO TRUSTS US

Calm hands when things are very much not calm

We measure ourselves on outcomes - short dwell times, clean recoveries, and reports that hold up under scrutiny.

Australian DFIR responders

ISO 27001 certified

DISP member

FAQ

Common questions about Incident Response

If you're in an incident now, don't read FAQs - call 1800 282 568.

READY WHEN YOU ARE

Get the right people on the call.

If you're already in an incident, call 1800 282 568 now. If you're getting ready in case - let's talk about a retainer.

Call IR hotline

Managed SIEM/SOC

Detect earlier so the next incident never makes it to a hotline call.

Managed EDR

Endpoint protection and managed response - the first line in a real incident.

Awareness Training

Reduce the human-driven incidents that fill our hotline most weeks.

Let's talk specifics

A short note about your environment is enough to start the conversation.