/en/services/cyber-risk/incident-response-litigation-support/incident-response-management service

Kroll Cyber Risk experts respond to over 3,200 security events every year. We manage incidents of all types, complexity and severity for organizations across diverse industries. You can count on Kroll’s unique frontline experience not only in a crisis, but also for proactive planning and mitigation strategies. We are among the top service providers preferred by major cyber insurance companies and offer client-friendly incident response retainers for peace of mind.

Fast and Efficient Deployment via Onsite and Remote Incident Response Capabilities

Whether your incident is the result of a malicious hacker or accidental exposure by an employee, Kroll can help now. Our global network of certified security and digital forensic experts can deploy remote solutions quickly and/or be onsite within hours to help you contain the situation and determine next steps.

Our incident response investigations follow the Kroll Intrusion Lifecycle, a step-by-step guide to the attack patterns our experts have observed through thousands of investigations each year.

Kroll is a leading provider of end-to-end cybersecurity, digital forensics and breach response services, and will help you make informed decisions at every stage, from proactive preparation to consumer notification and remediation. Our goal, working alongside your counsel and insurance carrier, is to smoothly guide you to recovery — one that leaves you standing in the best defensible position, reputation intact, and where business can proceed with minimal disruption.

Common Threats Addressed by Our Incident Response Team

Business Email Compromise and Wire Fraud

Insider Threats and Accidental Data Loss

Advanced Persistent Threats (APT)

Third Party and Vendor-Related Risks

Malware, Keyloggers, and Backdoors

Cryptocurrency Theft

Ransomware

Targeted Intellectual Property Theft

Payment Card Fraud (PCI/PFI)

Web Application Attacks and Password Theft

Kroll Offers a Continuum of Services for the Multifaceted Nature of Incident Response

  • Incident Response Planning: Enhance your organization’s ability to respond to cyberattacks with Kroll’s wide range of assessments, tabletop exercises and intelligence.
  • Intelligent Endpoint Detection and Response: Employing a powerful combination of technology and people, this sophisticated solution enables you to detect and respond swiftly to credible threats.
  • CyberDetectER® DarkWeb Search and Monitoring: Using our proprietary technology and unprecedented data stores, Kroll continuously monitors the deep and dark web to help clients ascertain and respond to data exposures.
  • Data Collection and Preservation: In the event of an investigation or litigation, Kroll offers cost-effective solutions to identify, isolate and preserve electronic data using forensically sound methodologies.
  • Data Recovery and Forensic Analysis: Kroll’s investigators are among the most knowledgeable subject matter experts practicing today; whether data was intentionally deleted or manipulated, they are able to analyze the clues left behind to quickly and defensively uncover critical information.

 

  • Malware and Advanced Persistent Threat Analysis and Remediation: Kroll’s forensic experts analyze malware to determine how it works and identify the scope of impact on your systems.
  • PHI and PII Identification: By providing you with a master notification list that clearly identifies the types of PHI or PII involved, we can help you avoid costly over-notification while still delivering targeted messages and remediation services to those affected.
  • Data Breach Notification Services: Protect your brand and reestablish trust with the individuals impacted by a data loss by matching the response to the harm caused by a breach.
  • Incident Remediation and Recovery Services: Expedite system recovery and minimize business disruption, with services including device and server reimaging, active directory rebuilding, network segmentation, hardware upgrades or replacements, patch management and network hardening.
  • Strategic Communications: Deftly navigate a host of risk and reputational landmines caused by a cyber crisis with a full suite of strategic communications support for incident response, preparedness and training. 
  • Malware Analysis and Reverse Engineering: Further understand any code-related event through our in-depth technical analysis of benign and malicious code.

 

Benefit From Client-friendly Incident Response Retainers

  • Includes proactive and reactive services
  • No loss of money at end of term
  • No required use of Kroll tools or applications
 

Start Now

 

  • No automatic renewals or price accelerations
  • Includes data response services that are core Kroll capabilities (e.g., Notification, Call Center, Monitoring and Consumer Restoration)
  • Key cyber insurance relationships, including some of the biggest underwriters in the world

 

Kroll in Action

Containment and Remediation of Cyberattack That Compromised Personally Identifying Information (PII)

Client: Major Company in U.S. Transportation Industry

Client Problem

The client contacted Kroll late on a Friday afternoon that it had suffered a cyberattack. The organization, which served a large national and international clientele, needed to contain and remediate the incident. It also would need to notify persons whose PII had been compromised and report the incident to regulators. 

 

How Kroll Resolved The Problem

  • Kroll deployed a response within two hours and had personnel onsite at the client’s headquarters by the next morning. The team eventually scaled from two investigators to 12 within 48 hours over the weekend. 
  • Upon identifying specific indicators of compromise (IOCs), we were able to eradicate the actor and establish containment; we also provided ongoing monitoring of the containment strategy to help assure effectiveness.
  • We created a disposition matrix, whereby we cross-referenced compromised machines with compromised individuals’ data.

 

Outcome

Our investigators were able to restore the client’s system with minimal disruption to its operations. Additionally, the findings of our disposition matrix enabled the client to refine its notification list with pinpoint accuracy.

Consequently, instead of implementing costly blanket notification (which also often generates intense media coverage), the client was able to notify and address the concerns of a much smaller subset of affected persons. The client ultimately not only dramatically reduced its notification and remediation costs, but also was able to provide regulators with precise details of the incident’s scope and effects.

 

Fortify Your Response Capabilities

Threats are growing in volume and sophistication and come from multiple directions. Leverage the frontline experience of our incident response and digital forensics team for multifaceted and confident response anywhere, anytime.

Increased Cyber Resilience with a Cyber Risk Retainer

Kroll delivers more than a typical incident response retainer—secure a true cyber risk retainer with elite digital forensics and incident response capabilities and maximum flexibility for proactive and notification services.

Frequently Asked Questions

Related Team

Connect with us

Mari Degrazia | Cyber Risk | Kroll
Mari DeGrazia
Associate Managing Director
Cyber Risk
Los Angeles
Phone
Pierson Clair
Pierson Clair
Managing Director
Cyber Risk
Los Angeles
Phone
Devon Ackerman
Devon Ackerman
Regional Managing Director, North America
Cyber Risk
New York
Phone
Courtney Dayter
Courtney Dayter
Associate Managing Director
Cyber Risk
Secaucus
Phone

See all servicesStay Ahead with Kroll

Valuation

Valuation of businesses, assets and alternative investments for financial reporting, tax and other purposes.

Compliance and Regulation

End-to-end governance, advisory and monitorship solutions to detect, mitigate and remediate security, legal, compliance and regulatory risk.

Corporate Finance and Restructuring

Comprehensive investment banking, corporate finance, restructuring and insolvency services to investors, asset managers, companies and lenders.

Cyber Risk

Incident response, digital forensics, breach notification, managed detection services, penetration testing, cyber assessments and advisory.

Environmental, Social and Governance

Advisory and technology solutions, including policies and procedures, screening and due diligence, disclosures and reporting and investigations, value creation, and monitoring.

Investigations and Disputes

World-wide expert services and tech-enabled advisory through all stages of diligence, forensic investigation, litigation and testimony.

Business Services

Expert provider of complex administrative solutions for capital events globally. Our services include claims and noticing administration, debt restructuring and liability management services, agency and trustee services and more.

Cyber


KAPE Quarterly Update – Q4 2022

Feb 06, 2023

by Eric ZimmermanAndrew Rathbun

Cyber


Hive Ransomware Technical Analysis and Initial Access Discovery

Feb 02, 2023

by Stephen Green, Elio Biasiotto

Cyber


Black Basta – Technical Analysis

Jan 23, 2023

by Stephen Green, Elio Biasiotto

Cyber


Live from Davos – Cyber in 2023: Geopolitical and Economic Risks

Jan 16, 2023

by Jason N. SmolanoffMegan  Greene

Press Release


Gartner Names Kroll a Representative Vendor for Managed Security Incident and Event Management

Jan 09, 2023

Press Release


Kroll Expands Partnership with CrowdStrike for Advanced Cybersecurity Offerings

Nov 10, 2022

Press Release


Kroll Adds Complimentary $1 Million Incident Protection Warranty to Managed Detection and Response (MDR) Service

Oct 26, 2022

News


Chief Financial Officers Ignoring Cyber Risk Worth Millions of Dollars According to Kroll Report

Sep 13, 2022

Webcast


KAPE Intensive Training and Certification

Online Event Apr 13 - Dec 07, 2023 | Online Event

Webcast


Q4 2022 Threat Landscape Virtual Briefing: Tech. and Manufacturing Targeted As Ransomware Peaks for 2022

Online Event Feb 15 - Feb 16, 2023 | Online Event