SERVICES · DFIR & INCIDENT RESPONSE
DFIR: contain the incident. Establish the facts.
BKK leads incident response and forensic investigation for ransomware, data theft, business-email compromise, insider incidents and cloud intrusions. We establish scope, preserve evidence and direct containment and recovery. Leadership and regulators receive a documented account of the findings and remaining uncertainties.
DFIR
Reconstruct what happened.
Bring separate evidence sources into one defensible account of an incident.
Preserve relevant artefacts and record their origin, handling and limitations.
Connect endpoint, identity and cloud observations. Separate verified facts from hypotheses.
Build an evidence-led timeline that explains scope, impact and the next decisions.
Incident response retainers
A retainer establishes access to BKK’s DFIR team under agreed service terms, with named contacts, prepared tools and response procedures. This preparation reduces uncertainty during the first hours of an incident.
-
Preparedness
Joint runbooks, communication channels and escalation paths defined before you need them.
-
Agreed response times
Service-level objectives for engagement start times and initial on-site or remote support.
-
Regional coverage
Teams experienced with regulatory regimes and operational practices across the Balkans and EU.
Digital forensics and incident investigation
Our DFIR teams collect and analyse evidence from endpoints, servers, cloud platforms and identity systems to reconstruct attacker actions and understand impact.
- Forensic collection following defensible, auditable procedures.
- Analysis of attacker tooling, persistence mechanisms and lateral movement.
- Clear scoping of affected systems, accounts and data sets.
Compromise assessments
Compromise-assessment engagements examine whether stealthy adversaries may already be present, using hunting methodologies and telemetry rather than waiting for alerts.
- Threat-led hypotheses based on your industry, technology and control environment.
- Hunt packages executed across EDR, SIEM, identity and cloud telemetry sources.
- Reporting that distinguishes between hard evidence, weak signals and absence of data.
Communication, regulators and lessons learned
An incident requires a coordinated technical and leadership response. We establish the verified facts, support communication with the responsible parties and turn the investigation into prioritised corrective actions.
-
Stakeholder communication
Support for internal and external communications, including templates and talking points.
-
Regulatory interface
Assistance with breach notifications, supervisory questions and evidence documentation.
-
Post-incident reviews
Structured lessons-learned workshops and remediation roadmaps across people, process and tech.
Set the response plan before the incident
Agree the scope, contacts and activation terms with BKK. Request a response retainer, compromise assessment or readiness review before a crisis forces the decision.