Most teams meet their forensics firm on the worst day of the year, then spend the first six hours explaining their own network. We keep senior responders on call, and for retainer clients we already have the map: your identity, your endpoints, your logs, your escalation path. When something moves, we contain it and we document it well enough to hold up with your insurer, your regulator, and your lawyers.
Netrix has run and secured mid-market environments since 1989, with a security operations center that never closes and responders who have worked the incident you are worried about.
Some of this happens in the first hour. Some of it happens six weeks later, when your insurer asks for the report. We do all of it.
Senior responders on a bridge, not a queue. We make containment decisions with your team, not for them, and we keep a running record from minute one.
Prepaid hours, a signed contract, and a team that already knows your environment. The paperwork is done before you need it.
We find out what actually happened, and we prove it. Evidence is handled so it holds up in a claim, an audit, or a courtroom.
The cheapest incident is the one you rehearsed. We write the plan, then we run your team through it until the gaps show up.
Nobody is improvising. This is the sequence we run, and what your team is doing while we run it.
One call starts it. A senior responder gets on a bridge with your team, and everyone agrees on who is deciding what before anyone touches a machine.
We find out how far in they got: which accounts, which endpoints, which data. Guessing at this stage is what makes an incident expensive.
Isolate what is compromised and cut the attacker's access, while keeping the parts of the business running that can safely keep running.
Remove persistence, reset the credentials that matter, and close the door they came in through. Eviction fails when it is rushed, so we verify.
Bring systems back in an order that does not reinfect you. We validate each tier before it reopens to users, starting with the ones the business needs first.
Root cause, attacker timeline, and a written report for your insurer, your regulator, and your board. Then a short list of what to fix first.
Three shifts, one file server, and a plant that could not afford to lose Monday.
Encryption started on a file server at 9:40 on a Friday night. The plant ran three shifts and the ERP system sat two hops away from the machine that lit up first.
Because the retainer was already in place, a responder was on the bridge before eleven with a diagram we had built during onboarding. Nobody spent the night asking which subnet the plant floor was on. Identity was contained by midnight and the domain was clean by Sunday. First shift ran Monday morning, and the carrier had the forensic report three weeks later.
Five things that change what the first day looks like.
Often both, and they do different jobs. The panel firm satisfies the carrier's claim requirements. We bring the environment knowledge, the credentials, and the containment work, and we operate under your counsel alongside them. If your carrier wants us pre-approved, we will help you get us added to the panel before you need it.
Retainers are priced on the size of your environment and the response window you want, so the number comes out of a short scoping call rather than a rate card. If you never declare an incident, the hours are not wasted. They roll into readiness work: tabletop exercises, plan reviews, backup validation, and the assessment that tells you where the next one would start.
Retainer clients get a written response commitment, and onboarding is what makes that number real. We already hold the network diagram, the identity map, the log sources, and your escalation list, so the first hour goes to containment instead of orientation. Non-retainer emergencies get triaged as fast as we can staff them, which is usually the same day.
Yes. Call 888.234.5990, extension 9999. The first conversation is triage, not paperwork: what you are seeing, what to stop touching, and what to preserve before it is gone. Contracting happens in parallel, and we will tell you honestly if someone else can get to you faster.
That is what it is built for. Chain of custody is documented from the first collection, findings are separated from opinion, and the timeline is written so an adjuster, an examiner, or a board can follow it without a translator. Where litigation is a possibility, we scope the engagement with your counsel from the start so privilege is handled properly.
Thirty minutes with an incident responder. We will walk your environment, look at what you would actually do in the first hour, and tell you whether a retainer is worth it for you.
Talk to an incident response engineerNo pitch deck. If your plan is already solid, we will say so, and you will have spent half an hour finding that out.