AWS forensics · CloudTrail · recovery

You were breached.
Find out how.
Then close the door.

The attacker is out, and now you need the whole story. The Investigation is that report: what happened, how, and what was touched, plus the draft for counsel, in two weeks for $30,000. The Recovery adds the fixes and a closure sweep, in four weeks for $50,000, with half the fee invoiced only when the sweep passes. If the attacker is still inside, start with the Response.

See the weeks Get the PDF brief

Retained through your outside counsel. Read-only in your workload accounts: your engineer runs our runbook to acquire a disk or memory, or your approver grants a scoped permission for named instances. The evidence and vault accounts are built for you and owned by you, and every change in your workload accounts goes through your own repositories. Not yet offered: there is no incident phone number or mailbox, there is no response-time commitment without a Retainer, and these terms are under counsel review.

A long underground bank vault corridor receding into shadow, rows of closed steel deposit doors on both walls and a single beam of cool light across the polished floor.

The incident path

Contain it first. Then the whole story. Then the fixes.

Three steps that differ by urgency and by goal, and so by how they are priced. They run in this order, or start on their own.

  1. Contain

    The Response

    Urgency
    Right now. A law firm calls, and Charles logs in at once to contain and remediate in real time.
    Goal
    Containment: the attacker locked out, the damage stopped, the evidence kept.
    Priced
    By the hour, at the high rate: $675 per hour.

    Ends when you declare containment in writing.

    See the Response

  2. Investigate

    The Investigation

    Urgency
    Urgent, but deliberate. It starts after containment, at a steadier pace.
    Goal
    A full report of the incident: what happened, how, and what was touched, plus the draft for counsel.
    Priced
    A fixed fee: $30,000 for two weeks.

    Ends with the report, read out to counsel and your sponsor.

    On this page

  3. Recover

    The Recovery

    Urgency
    Planned work, once you know the story.
    Goal
    Fix the root causes and prove closure.
    Priced
    A fixed fee: $50,000 for four weeks, half invoiced only when the closure sweep passes.

    Ends when the closure sweep passes.

    On this page

2
Weeks to the Investigation’s answer
4
Weeks to the Recovery’s closure sweep
50
Accounts in scope, every enabled Region
10
Compromised instances for disk and memory analysis

Know what happened, or fix it too.
Both fixed price.

Fixed scope, fixed price, one signature through your counsel. Both are scoped to the logs you hold and priced before the work starts, which an attack in progress cannot be.

Two weeks

The Investigation

$30,000

Invoiced in full at signature.

Not yet offered.

One AWS organization, read from the inside, with the attack traced across every account. How they got in, what they touched, and whether they are still in.

  • Evidence preserved first (if a Response did not already), with a chain-of-custody log counsel can authenticate
  • The estate mapped: every account, principal, trust path, key, network path, and log source, with the log gaps recorded
  • Every attacker session reconstructed across accounts and role chains, in a minute-by-minute timeline
  • A compromise inventory of everything the attacker used, created, changed, read, or copied, with confidence
  • Indicators of compromise, in a table and in machine-readable form
  • The causal analysis of how the attack worked, and, apart from it, a control gaps and fix plan for your IT team
  • A legal-considerations draft and notification-clock worksheets for counsel, a factual summary for counsel to release, and an executive brief read out to counsel and the sponsor

Charles’s time: up to 50 hours over the two weeks. Disk and memory analysis comes out of those hours, not on top of them: if a host-heavy breach uses them first, the rest is done by change order at $450 per hour, with an estimate of the hours each remaining host needs. Beyond the cap, $450 per hour by written change order, agreed before the hour is spent.

After a Response, the preservation and tracing hours already worked are credited at $450 per hour, up to $10,000, against the signature invoice.

Gated
Four weeks

The Recovery

$50,000

Half at signature, half only when the gate is met.

Not yet offered.

The Investigation in the first two weeks. Then week three removes what the attacker left and fixes the root causes as code, and week four runs the closure sweep the same way as week one.

  • Everything in the Investigation
  • Every confirmed item in the compromise inventory removed, isolated, restored and verified, or covered by a named written acceptance, after it is preserved
  • Every critical root cause fixed as code, through your repositories and your review
  • Guardrails that would have stopped this attack attached at the organization, proven in a staging unit first
  • A closure sweep: the week-one map and every indicator search run again the same way, plus seven days of watching with no indicator active
  • The factual summary updated, the final custody log, and a runbook for this attack

Charles’s time: up to 110 hours over the four weeks. Beyond that, $450 per hour by written change order, agreed before the hour is spent.

The gate. The second half of the fee is invoiced only when the closure sweep finds every confirmed item in the compromise inventory removed, isolated, restored and verified, or covered by a named written acceptance (an item that cannot be confirmed has a documented disposition), no indicator of compromise active in the final seven days, and every critical root cause closed as code. A gap that remains in objects that already exist is disclosed as a residual risk with an owner and a date. The gate measures our work, not your choices: a critical root cause you accept in writing, or whose fix you decline, counts as closed. It is a gate on a second invoice, not a warranty that the attacker is out.

No standing write access. Every change in your workload accounts goes in as code, through your repositories and pipeline. The roles are deleted at the end, and the sweep proves it.

Who this is for

  • A breach you know about: stolen keys, an abused role, ransomware by key or by deletion, data copied out, or a compromised instance
  • An AWS organization of up to 50 accounts (more by change order), with an organization trail or account trails that cover the period in question
  • A control-plane attack, or a workload compromise on EC2, containers, or Lambda inside AWS
  • Outside counsel, or the willingness to engage counsel at the start

Who it is not for

  • Incidents whose evidence is mostly outside AWS: on-premises networks, laptops, mobile devices, email tenants, or SaaS. We say so on the first call, name the gap, and analyze the AWS side only
  • Anyone who wants the attacker contacted, negotiated with, or paid, or who wants to hack back. We never do
  • Anyone who needs a testifying expert, or who needs us to certify that data was “not accessed” in words that settle a notice duty. We report what the evidence shows; counsel decides what it means
  • An attack still in progress. That is the Response, by the hour, and the Investigation follows it
Take it with you

The brief, as a PDF.

Everything on this page in a document you can hand to the person who signs: scope, weeks, deliverables, price, and terms. It is tagged for screen readers.

Two weeks to the answer.
Four to the closed door.

The Investigation is weeks one and two. The Recovery is those weeks and two more.

The Investigation · two weeks · $30,000
  1. Week 1
    Preserve and map.The read-only role goes into every account on day one, plus the evidence account. Evidence is preserved first if a Response did not already, the estate is mapped (every account, principal, trust path, key, network path, and log source), and the log-readiness gaps are recorded. The whole period is loaded and every known indicator searched. Interviews with your platform lead and whoever found the breach.
  2. Week 2
    Trace and report.Every attacker session reconstructed across accounts and role chains. The timeline from first access to containment, the compromise inventory, the indicators, the causal analysis, the control gaps and fix plan, the legal-considerations draft and the clock worksheets for counsel, a factual summary for counsel to release, and the executive brief, read out to counsel and the sponsor.
The Recovery · the Investigation, then two weeks · $50,000
  1. Weeks 1–2
    The Investigation.Everything on the left, first.
  2. Week 3
    Eradicate and close.Every confirmed item in the compromise inventory removed, isolated, restored and verified, or covered by a named written acceptance, after it is preserved. An item that cannot be confirmed gets a documented disposition. Every critical root cause fixed as code through your repositories and review. The guardrails that would have stopped this attack attached at the organization (non-AWS key origins, imported key material, customer-supplied encryption keys, external sharing of snapshots, lifecycle and versioning changes, trail changes), proven in a staging unit first.
  3. Week 4
    Closure sweep and hand over.The closure sweep: the week-one map and every indicator search run again, the same way, plus seven days of watching with no indicator active. The factual summary, updated, the final custody log, the runbook for this attack, and the closing readout.

The gate, in one sentence. At week four, the closure sweep, run the same way as in week one, finds every confirmed item in the compromise inventory removed, isolated, restored and verified, or covered by a named written acceptance (an item that cannot be confirmed has a documented disposition), no indicator of compromise active in the final seven days, and every critical root cause closed as code. A gap that remains in objects that already exist is disclosed as a residual risk with an owner and a date. A critical root cause you accept in writing counts as closed, as does one whose fix you declined, or approved but had not applied before the sweep: the gate measures our work, not your choices. If the attacker returns in the last seven days, we rerun the sweep after the new activity is closed and the second invoice waits for the rerun; the hours to chase them and to rerun the sweep are inside the cap. If the gate is still not met after the rerun, the second invoice is not issued.

What you hold at the end.

Every report carries its distribution line: counsel only, operational for your incident team, or releasable once counsel clears it.

The Investigation · eleven documents
  1. 01
    Estate Map and Evidence Preservation · Counsel onlyThe organization as it stood, every log source and its gaps, and what was preserved, so every later claim has a source.
  2. 02
    Attack Narrative and Timeline · Counsel onlyWhat the attacker did, in order, minute by minute, from first access to the last attempt, with each step’s evidence.
  3. 03
    Indicators of Compromise · Releasable once counsel clears itEvery indicator in one table and in machine-readable form, for your detections, your peers, and law enforcement.
  4. 04
    Executive Brief · Counsel onlyHow they got in, what they touched, whether they are out, and what is still unknown, for the board.
  5. 05
    Compromise Inventory · Counsel onlyEvery principal, credential, resource, and data set the attacker used, created, changed, read, or copied, with confidence.
  6. 06
    Root Cause: How the Attack Worked · Counsel onlyThe causal analysis: why the attack worked at each step, with each step’s evidence.
  7. 07
    Control Gaps and Fix Plan · OperationalThe gaps in the estate, what closes each one, and which are critical. Controls and fixes only, with no attack narrative; it defines “critical” for the gate. In the Wrenfield sample it is the detachable appendix of the Root Cause report, which counsel detaches for your IT team.
  8. 08
    Legal and Regulatory Considerations: Draft for Counsel · Counsel onlyThe facts counsel needs, organized by the regimes counsel may want to consider. A draft for counsel, not legal advice.
  9. 09
    Notification-Clock Worksheets · Counsel onlyThe deadlines that may run from your own determinations, brought up to the Investigation’s facts.
  10. 10
    Factual Summary for Regulators, Insurers, and Auditors · Releasable through counselFacts only, no analysis or opinion, at the Investigation’s readout, for counsel to release. The Wrenfield sample holds only the edition updated at the Recovery’s close.
  11. 11
    Chain-of-Custody Log · Counsel onlyEvery evidence item from collection to storage, hashed, so counsel can authenticate it.
The Recovery · all thirteen, two more
  1. 12
    Eradication and Root-Cause Closure · OperationalThe disposition of every inventory item (removed, isolated, restored and verified, or accepted in writing) and every critical root cause fixed as code, with its pull request.
  2. 13
    Closure Sweep · OperationalThe gate: week one against week four, the same method, and seven days of watching.
  3. 14
    Factual Summary, updated · Releasable through counselThe Investigation’s summary brought up to the closure sweep’s results, for counsel to release.
The sample

See the whole engagement,
start to finish.

The Investigation and the Recovery run for the same bank a week after its Response: four weeks, with half of the Recovery fee riding on a closure sweep. Every report is a PDF you can open.

A long underground bank vault corridor receding into shadow, rows of closed steel deposit doors on both walls and a single beam of cool light across the polished floor.
Sample case study · every deliverable, downloadable

Wrenfield: the Investigation and the Recovery

The one for a bank that knows it was breached. A regulated company that has contained the attack and now has to tell its board, its regulators, and its insurer how it happened, what was touched, and whether the attacker is out.

A fictional regional bank, a week after the ransom note: how the attacker got in, what they touched, whether they are out, and the six root causes (3 of 3 critical closed as code, 1 accepted in writing), with half of the $50,000 Recovery fee riding on a closure sweep.

Read the sample case study

Every report, by engagement and week:Wrenfield All samples

How much of Charles you get.

Fixed price does not mean unbounded. The cap is in the statement of work, and so is what we need from you.

The Investigation
Up to 50 hours

Over the two weeks: evidence handling, the estate map, the tracing, and eleven documents, eight of them for counsel only. Disk and memory analysis comes out of these hours.

The Recovery
Up to 110 hours

Over the four weeks: the Investigation, the eradication and fixes, and the closure sweep.

Beyond the cap
$450 per hour

By written change order, agreed before the hour is spent. Remote by default; an on-site day is priced separately.

Scope
  • One AWS organization of up to 50 accounts, every enabled Region
  • The logs you hold for the period in question (default: the 90 days before discovery; longer by change order)
  • Disk and memory analysis of up to 10 compromised EC2 instances or container hosts, within the included hours (a ceiling, not a promise that the hours reach it)
  • Server logs the workloads write in AWS (application logs, load balancer and CloudFront logs, VPC Flow Logs, S3 server access logs, database audit logs). Where they are missing, the absence is itself a finding
What we need from you
  • Outside counsel who signs the Counsel Engagement Letter and the statement of work, both written new for this incident. We contract through counsel by default
  • The read-only role in every account in scope on day one, from a CloudFormation StackSet we hand you and you read first (a StackSet does not deploy to the management account, so that one is a separate stack)
  • Time with your platform lead and with whoever found the breach
  • For the Recovery: engineers who review and merge the fixes in your repositories, and approve them before the sweep
Access and evidence

Read-only on your accounts.
Write access only where the evidence is.

The role has the same explicit denies on reading stored data as the security engagement’s. Write access exists only in the evidence and vault accounts we create for the engagement, and they belong to you from the day they are built. Disk and memory are acquired either by your engineer running our written runbook or under a scoped permission your approver grants for named instances, and the custody log records it.

Capture before change

The state of anything is captured and hashed before it changes, and nothing is destroyed unless you approve a specific destructive step in writing. Analysis is on copies.

Counsel only

Counsel-track reports go to counsel only, and counsel decides who else sees them. The operational track, including the fix plan, works with your IT team.

A separate factual summary

Facts only, with no analysis or opinion, for counsel to release to auditors, insurers, and regulators.

No legal conclusions

Reports never say reportable, material, not a breach, or not accessed in a way that settles a duty. Attribution is “consistent with,” never “was.”

Changes through your pipeline

Every change in your workload accounts is a pull request in your repositories, reviewed by the engineer who owns the account.

Roles deleted, copies deleted

The roles are deleted at the end and the sweep proves it. Vantalect retains its working copies until counsel authorizes destruction in writing after confirming preservation obligations, then deletes the authorized copies and provides a certificate on the agreed schedule.

The tools of the engagement.

Native AWS logs and controls, a locked evidence account, and a custody log.
Everything the engagement produces is left with you.

Reconstruction

CloudTrail and CloudTrail Lake

The organization trail, the account trails, and the Lake load for the period are the spine of the timeline, with log-file integrity validation recorded.

Preservation

The evidence account

A dedicated forensic account behind deny-all policies after build, with versioned buckets under S3 Object Lock in compliance mode and keys you hold.

Chain of custody

The custody log

SHA-256 at acquisition and after every transfer, who, when, from which resource, so counsel can authenticate the evidence.

Who does the work

Charles Sieg, personally, with the agents he directs. The sample engagements on this site are fictional. Vantalect is a consulting expert to your counsel, not a law firm, and its reports are not legal advice.

Questions a CISO and counsel ask first

What is the difference between the Investigation and the Recovery?

The Investigation answers what happened: how they got in, what they touched, and whether they are still in. The Recovery is the Investigation plus the fixes: every confirmed inventory item removed, isolated, restored and verified, or accepted in writing, the critical root causes closed as code, and a closure sweep that proves it. Half the Recovery fee is invoiced only when the sweep passes.

Why is it retained through counsel?

Courts look at purpose, who received the report, and the paperwork, not the label on the cover. A three-party letter, with counsel retaining Vantalect for this incident, is the structure most likely to support a privilege claim. Counsel decides, and counsel-track reports go to counsel only.

Can you tell us whether we have to notify anyone?

No. We report what the evidence shows and organize the facts by the regimes counsel may want to consider, with notification-clock worksheets computed from the times you record. Whether a regime applies, and when its clock began, is for you and your counsel.

What if the attacker is still in?

Then you need the Response first: hourly, by the stage, to stop the damage and preserve the evidence. The Investigation starts after containment, and the Response hours already worked are credited against it, at $450 per hour, up to $10,000.

What if our logs are incomplete?

We record the gaps in week one and say what they limit before any conclusion. Missing logs are a finding, with the fix and its monthly cost. We do not fill gaps with guesses.

Will you contact or pay the attacker?

No. We never contact, negotiate with, or advise on paying an attacker, and never touch ransom funds. We give counsel the technical indicators for sanctions screening.

Will our insurer cover this?

Many cyber policies expect a panel vendor or written consent for another. Ask your broker now to list Vantalect as a named non-panel provider. Without a listing, your broker requests consent first, and costs the insurer has not consented to may not be reimbursed.

Is this legal advice?

No. Nothing Vantalect delivers is a legal determination. Vantalect does not need a private-investigator license for this work.

What insurance does Vantalect carry?

Vantalect carries errors-and-omissions insurance. It carries no cyber insurance and expects to need none. Liability is capped as the master services agreement sets out.

What are the agents, and who sees our data?

Charles directs software agents (AI tools) that read, analyze, and draft under his supervision, and he reviews every deliverable. By default they work inside your evidence account and your own accounts. Evidence goes to any other provider or region only with the written consent of you and counsel, under terms that bar training and retention. Pursuit, our tracker, reconstructs attacker sessions from the recorded API calls and runs in an account you own. We retain our working copies until counsel authorizes destruction in writing after confirming preservation obligations. We then delete the authorized copies and provide a certificate on the agreed schedule.

Three offers, one incident path.
Before, during, and after.

The Response runs while the attack does. The Investigation and the Recovery follow it, or start on their own for a breach found later. The Retainer buys back the first hour of the next one.

A three-story brick office building at night in heavy rain, one amber window lit on an upper floor and lightning glow in the clouds behind it.
AWS incident response · containment · evidence

AWS Incident Response

Something in your AWS organization is deleting snapshots and changing keys right now, and it is not your pipeline.

Read the engagement
An empty stone-paved town square in front of a columned limestone civic building at pre-dawn after a storm, wet paving reflecting a clearing sky and one street lamp still lit.
AWS incident readiness · one year · prepaid hours

AWS Incident Response Retainer

When it happens, the first hour goes to finding a lawyer, signing paper, and creating a role. Spend that hour now.

Read the engagement

The five fixed-price engagements are separate: compare them on the home page. The incident offers are not bundle members.

Not yet offered.

Vantalect does not yet offer the Investigation or the Recovery. No incident phone number or mailbox is published, nothing on this page is an offer, and there is no response-time commitment without a Retainer; round-the-clock response with commitments is a Retainer feature. If an attack is in progress, call AWS Support and your own outside counsel.

Not yet offered.

AWS, Amazon Web Services, and the AWS service names are trademarks of Amazon.com, Inc. or its affiliates. Vantalect is not affiliated with or endorsed by any of them.