DFIR and VAPT services
Respond when it is real, test before it is
DFIR that responds when an attack is real, and VAPT that tests your own systems the way an attacker would, under written authorization.
- Incident reporting
- [email protected]
- DFIR
- Retainer of 50 analyst hours
- VAPT
- Quoted per engagement
- Response
- Contact in 1 hour, engagement in 4
Under attack
A breach is decided in the first hours
Rushed recovery destroys the evidence needed for root cause and legal defense.
DarkOps DFIR
An expert team, not just a playbook
Responders paired with forensic analysts who preserve memory, disk images and logs with chain of custody.
Rapid engagement and triage
initial contact within 1 hour, remote engagement within 4 hours.
Forensic investigation
RAM and disk acquisition with chain of custody, malware analysis and a MITRE ATT&CK timeline.
Containment and eradication
across hosts, AD and cloud, without losing evidence.
Recovery support
guided restoration of critical services and clean-state verification.
Hardening roadmap
remediation plan and detection rules so the same door does not open twice.
Executive and technical reporting
forensic report, board summary and machine-readable IOCs for legal and regulatory use.
Incident response, phase by phase
A structured response, with the evidence intact
Four phases, with digital forensics as a parallel track through every phase.
- Preserve volatile evidence
Triage
Scope the incident, stabilize and set priorities together.
- Image affected systems
Contain
Stop the spread and cut off access, keeping the evidence.
- Analyze and reconstruct
Eradicate + Recover
Remove the threat and restore systems and services safely.
- Report who, how and when
Review
Findings, root cause and a plan to prevent a repeat.
DarkOps VAPT
Prove what is exploitable, before an attacker does
Infrastructure, web, mobile, API and cloud, tested the way an attacker would, under written authorization. Critical findings within 24 hours.
- One-off or recurring
Vulnerability assessment
Authenticated and unauthenticated scans; every finding above Low validated by an analyst.
- Black, gray or white box
Penetration testing
Manual, goal-based testing that chains weaknesses to show real impact, within agreed boundaries.
- Written authorization
Rules of engagement
Agreed windows, no denial of service or destructive actions, a stop rule through named contacts.
- CVSS 4.0 severity
Reporting and attestation
Findings with evidence, severity and the fix, and an attestation letter for auditors.
- Ordered fix plan
Remediation workshop
A readout with your teams that turns the findings into an ordered fix plan.
- Within 90 days
Retest
Every Critical and High finding re-verified and marked fixed, partially fixed or open.
Engagement
Choose how DarkOps stands by you
Every DarkOps license is standalone and holds DFIR, VAPT or both.
- DFIR
DFIR retainer
A prepaid retainer of 50 analyst hours, valid 12 months; further hours are added as the incident needs them.
- Initial contact within 1 hour, remote engagement within 4 hours
- Agreed contacts, scope and escalation path
- Standalone or alongside any DARKMON license
- VAPT
VAPT engagements
Licensed per engagement, by type and size, in a Small, Medium or Large band set by the number of targets.
- Infrastructure, web, mobile, API or cloud configuration
- Wireless and phishing simulation as add-ons
- One retest of every Critical and High finding included
Works withCompromise AssessmentCrestaNyxelForesynThreat Advisory SuiteEradix
Deliverables arrive through DARKMON One, with the same analyst publish gate as every DARKMON TIRU deliverable.
Before the incident, before the attacker
Arrange a retainer. Scope a test.
Agree on terms, contacts and scope before you need them. Under attack now? Report an incident to [email protected].