Incident Response: First day – and first response

It’s not often that you have to alert a brand new Managed Detection and Response client that it’s in the middle of an incident on the first day on the job, but that’s just what happened with this customer. Mehmet Surmeli, Senior Incident Response Consultant, talks through how a routine deployment of our EDR agents to a new client revealed a compromise in progress - and an imminent ransomware attack. Find out how he and the team discovered the threat, worked out how to fix it – and when the attacker was likely to be taking a break, so they could successfully kick them off the network.