Response built around the systems you actually have
Older applications, Windows servers, local directories and remote-access systems still support essential business operations. We scope investigation around available evidence and operating constraints, without assuming every device has modern endpoint telemetry. AI-assisted attacks against these systems still require careful identity, host and network investigation.
Agree coverage and decision ownership
| Area | Scoping question |
|---|---|
| Endpoints and servers | Which systems and records are available for investigation? |
| Identity and remote access | Which accounts and access paths may be involved? |
| Business applications | Which dependencies constrain containment or restoration? |
| Backups and virtualisation | Who can approve access and select recovery sources? |
| Microsoft 365 integration | Which identities and services cross the local/cloud boundary? |
Destructive changes, evidence acquisition and restoration work require explicit authority. Any limits caused by unsupported software, missing records or unavailable access are recorded in the engagement.
Recovery requires verified conditions
Agree the critical services, recovery source, identity safeguards and checks before reconnecting affected systems. Keep confirmed containment separate from complete incident resolution. AI-assisted analysis can help organise evidence but cannot replace missing telemetry or the judgement of accountable system owners.
Preparation guides
Get help with the affected business systems
Explore this response workstream or our AI incident response services. You do not need to operate an AI application or prove the attacker used AI to request help. Describe the affected systems, observed impact and urgency; we confirm availability and agree an authorised scope.
Send only non-sensitive context through the website. If company email may be compromised, use a trusted communication channel and avoid sharing the investigation through the suspected account.
