When you experience a breach, our CRITICALSTART® Cyber Incident Response Team (CIRT) takes action immediately to minimize the impact on your business. Our team of Microsoft 365 security experts extends your team, not attacker dwell time, with robust IR, forensic and IR monitoring services tailored specifically for your Microsoft Security environment including:

Incident Response

• Malware reverse engineering to develop Indicators of Compromise (IOCs) and other details to aid identification of similar code, and to support threat hunting activities
• IR monitoring of your Microsoft 365 environment for 30 days to aid in the identification, containment, and remediation of threats, and to support targeted threat hunting operations (optional for non-CRITICALSTART® customers)
• Crisis management to lead your team through the critical stages of an incident
• Initial, interim, and final findings reports and briefings

Forensic Services

Our CIRT relies on the latest industry-proven tools, techniques, and procedures to reach comprehensive investigation results. Our forensic investigators collectively bring vast knowledge, industry certifications, degrees, and experience to every engagement.

• Digital forensic investigations (PCI-DSS) are available for highly sensitive investigations (on-site and remote)
• Evidence seizure, chain-of-custody, and secure storage
• Forensic imaging and analysis
• Investigative reporting
• Courtroom testimony

IR Monitoring

Our IR Monitoring service utilizes the power of our Zero Trust Analytics Platform™ (ZTAP™) to help identify, contain, and remediate threats, as well as to support targeted threat hunting operations during a breach.

• Active 24x7 monitoring of your Microsoft 365 environment by seasoned professionals and purpose-built technology
• Context-based alert prioritization tuned from each customer’s threat assessment and business impact analysis
• 30-day demo license for integrated Microsoft security products, like Microsoft 365 Defender and Sentinel EDR products
• Leveraging global and customized/personalized playbooks and threat intelligence
• Handle breaches across diverse attack vectors.

Key Benefits

• Minimize risk, reduce exposure, and preserve evidence
• Meet compliance, legal, HR, and insider threat investigation requirements
• Resolve incidents in days, not weeks, and return to normal business operations faster than industry norms
• Promptly respond to security incidents and minimize their impact
• Reduce risk exposure and identify unknown attacker
• Tactics, Techniques, and Procedures (TTPs) through the application of TTP Playbooks and constant tuning of automated alerts and blocking mechanisms
• Preserve evidence through the comprehensive aggregation of alerts and artifacts
• Improve your overall security posture with enhanced visibility into activity within your environment
• Establish baselines through continuous monitoring
• Control the scope and severity of alerts for which you are notified and the cadence of those notifications

Why Critical Start?

Critical Start has a longstanding partnership with Microsoft, dating back to the early days of the Microsoft Security suite. The company was an initial member of the Microsoft Security Partner Advisory Council and is currently a Design-Build partner, a MISA member, a Microsoft security solutions partner, and an inaugural member of the MXDR Partner program. In addition, CIRT comprises professionals with more than 70 years of collective experience in digital forensics for federal law enforcement, the Department of Defense, intelligence agencies, and the private sector. Our forensic examiners have testified as expert witnesses in federal court.