AWS incident response · containment · evidence

Under attack?
Stop the damage.
Keep the evidence.

A law firm calls, and Charles logs in at once. He contains and remediates in real time, paid by the hour and retained through your outside counsel: the attacker’s access cut, the damage stopped, the evidence preserved as he goes. The goal is containment, and the engagement ends when you declare it in writing. The full report of the incident is the Investigation, which comes next.

See the six stages Get the PDF brief

$675 per hour, any hour of any day, with no premium for nights, weekends, or holidays. $450 per hour for a Retainer holder. Not yet offered: there is no incident phone number or mailbox, and these terms are under counsel review. Without a Retainer there is no response-time commitment; round-the-clock response with commitments is a Retainer feature.

A three-story brick office building at night in heavy rain, one amber window lit on an upper floor and lightning glow in the clouds behind it.

The incident path

Contain it first. Then the whole story. Then the fixes.

Three steps that differ by urgency and by goal, and so by how they are priced. They run in this order, or start on their own.

  1. Contain

    The Response

    Urgency
    Right now. A law firm calls, and Charles logs in at once to contain and remediate in real time.
    Goal
    Containment: the attacker locked out, the damage stopped, the evidence kept.
    Priced
    By the hour, at the high rate: $675 per hour.

    Ends when you declare containment in writing.

    On this page

  2. Investigate

    The Investigation

    Urgency
    Urgent, but deliberate. It starts after containment, at a steadier pace.
    Goal
    A full report of the incident: what happened, how, and what was touched, plus the draft for counsel.
    Priced
    A fixed fee: $30,000 for two weeks.

    Ends with the report, read out to counsel and your sponsor.

    See the Investigation

  3. Recover

    The Recovery

    Urgency
    Planned work, once you know the story.
    Goal
    Fix the root causes and prove closure.
    Priced
    A fixed fee: $50,000 for four weeks, half invoiced only when the closure sweep passes.

    Ends when the closure sweep passes.

    See the Recovery
6
Stages, each ending at a decision you make in writing
60 min
With no successful attacker write before containment moves on
24 h
Activation authorization: a deposit, not a minimum
80 h
Default not-to-exceed, until you extend it in writing

Hourly, through your counsel,
from the first call to containment.

One engagement, no fixed weeks. Each stage ends at a named decision your incident lead and counsel make in writing. An email is enough.

From activation to containment declared

The Response

$675 per hour

$450 an hour for Retainer holders. Any hour of any day, with no minimum blocks.

Not yet offered.

A responder who stops the damage first and preserves the evidence while doing it, for one AWS organization. The engagement runs from activation until your incident lead declares containment.

  • Containment that captures each setting before it changes it, and records every change: a deny-list service control policy on the affected unit, the attacker’s credentials disabled, sessions revoked, destructive jobs canceled, destructive settings reversed
  • Every action proposed, approved by a named approver of yours, and logged with its rollback
  • Evidence preserved first: logs copied to a locked evidence account, disk and memory acquired from compromised instances before they are touched, every item hashed
  • An isolated vault account where data is at risk, such as an expiring key or a deletion schedule, with keys you hold
  • Persistence removed after it is preserved, and the initial access path closed
  • Six reports on two tracks, counsel-only and operational, with an interim factual statement for counsel to release

Charles’s time: billed as worked, logged in 6-minute increments in an hour log you can read. You set a not-to-exceed figure at activation (default 80 hours). We tell you at 80% of it. At the figure we finish the action in progress, tell you in writing what is left unprotected, and stop until your incident lead and counsel extend it in writing.

Containment, not cleanup. Rebuilding systems, rotating every secret in the estate, and root-cause fixes beyond the initial access path belong to the Recovery.

How the money moves

A deposit, then weekly invoices.

The rate
$675 per hour for every hour, logged in 6-minute increments. The rate covers Charles and the agents he directs; they are not billed separately.
Activation authorization
$16,200 (24 hours), invoiced at activation and due on receipt. $10,800 for a Retainer holder, invoiced to counsel’s matter like any other hour and not drawn from prepaid hours. It is a deposit against hours, not a minimum.
After that
Weekly invoices in arrears, due in 15 days. Any unused part of the authorization is credited to your next invoice or to an Investigation, or refunded within 15 days of containment declared.
Not-to-exceed
You set it at activation; the default is 80 hours. Work stops there for your written extension.
A following Investigation
Preservation and tracing hours already worked are credited at $450 per hour, up to $10,000, against the signature invoice of an Investigation or Recovery.

Who this is for

  • A CISO, CIO, or general counsel whose production runs in an AWS organization of up to 50 accounts (more by change order), with an organization trail or account trails that cover the period
  • A control-plane attack: stolen keys, abused roles, ransomware by key or by deletion, data copied out
  • A compromise of EC2, containers, or Lambda inside AWS
  • Outside counsel, or the willingness to engage counsel at the start

Who it is not for

  • Incidents whose evidence is mostly outside AWS: on-premises networks, laptops, mobile devices, email tenants, or SaaS. We say so on the first call, name the gap, and analyze the AWS side only
  • Anyone who wants the attacker contacted, negotiated with, or paid, or who wants to hack back. We never do
  • Anyone who needs a testifying expert. Vantalect is a consulting expert to your counsel; testimony is a separate engagement
Take it with you

The brief, as a PDF.

Everything on this page in a document you can hand to the person who signs: scope, weeks, deliverables, price, and terms. It is tagged for screen readers.

Six stages.
Each ends at your decision.

The Response has no fixed weeks. It has stages, in this order, and each is closed by someone on your side saying so in writing.

The Response, by stage
  1. Stage 0
    Activation.Counsel signs a Counsel Engagement Letter and an incident statement of work, both written new for this incident and billed to counsel’s matter. You deploy our incident role from a template you read first, and the bridge opens. Insurer notice runs in parallel through your broker. It ends when the role works and the bridge is staffed.
  2. Stage 1
    Stop the bleeding.Containment that captures each setting before changing it. Before every action, the state it will change (credential reports, access-key last-used data, policies, key policies, lifecycle and deletion settings, active sessions, job manifests) is captured, hashed, and saved to a locked location, and the change is recorded in the trail and the custody log. Then a deny-list service control policy on the affected unit, the attacker’s credentials disabled and sessions revoked, destructive jobs canceled, destructive settings reversed. Each action is proposed, approved by a named approver of yours, and logged with its rollback. It ends when the attacker’s credentials show no successful write for 60 minutes.
  3. Stage 2
    Preserve.The organization trail and every other log source copied to an evidence bucket under S3 Object Lock in a new forensic account, with CloudTrail Lake loaded for the period. KMS key policies, IAM state, and resource configuration captured. Disk and memory acquired from any compromised instance before it is touched, and every item hashed and entered in the chain-of-custody log. It ends when the log covers every source named at activation.
  4. Stage 3
    Protect and recover.Where data is at risk, such as an expiring key, a lifecycle clock, or a deletion schedule, an isolated vault account in its own unit behind a deny-all policy, with keys you hold. Data is copied in, verified, and locked, and clean restores go into production as you approve each. It ends when nothing you need depends on a key or a setting the attacker controls.
  5. Stage 4
    Eradicate.Every persistence mechanism removed after it is preserved, the initial access path closed, trust policies and keys reissued. It ends when following every attacker credential shows none alive.
  6. Stage 5
    Containment declared.Your incident lead declares containment in writing. The executive brief, the notification-clock worksheet, and an interim factual statement go to counsel.

The honest limit. Without a Retainer there is no response-time commitment. One consultant cannot promise one while he may be on a bridge for another client. No incident phone number or mailbox is published. Round-the-clock response with commitments is a Retainer feature: a Retainer holder gets written commitments, with service credits when they are missed.

What you hold at containment.

Six reports. Each carries its distribution line: counsel only, operational for your incident team, or releasable through counsel.

The Response · six reports
  1. 01
    Situation Reports · OperationalOne every 12 hours, more often in stage 1: confirmed facts, working hypotheses labeled as such, actions taken and proposed, decisions needed, clocks running, and what is not yet known.
  2. 02
    Containment and Eradication Actions · OperationalEvery action, who approved it, what it changed, what was preserved first, and how to undo it, with the policies attached and what was deliberately not done.
  3. 03
    Executive Brief at Containment · Counsel onlyOne page the CEO and board can read: what happened, what is protected, what is still unknown, and which decisions are theirs.
  4. 04
    Notification-Clock Worksheets, interim · Counsel onlyThe deadlines that may run from your own determinations, computed from the times you enter, with the facts each one needs. The first goes to counsel within six hours of activation, and it is updated whenever you record a trigger. A worksheet for counsel, not legal advice.
  5. 05
    Chain-of-Custody Log · Counsel onlyEvery evidence item from collection to storage, hashed, so counsel can authenticate it.
  6. 06
    Interim Factual Statement · Releasable through counselFacts only, with no analysis or opinion, at containment declared, for counsel to release to your auditor, insurer, a regulator, or the board. The Wrenfield sample does not include this statement.
The sample

See the whole engagement,
start to finish.

The Response run end to end for a fictional regional bank, six stages over six days. Every report is a PDF you can open, and the stage each one belongs to is named.

A three-story brick office building at night in heavy rain, one amber window lit on an upper floor and lightning glow in the clouds behind it.
Sample case study · every deliverable, downloadable

Wrenfield: the Response, on a holiday weekend

The one for a bank under attack. A regulated company whose outside counsel needs a responder on the bridge tonight, with every action approved, logged, and reversible, and the evidence kept for what comes after.

A fictional regional bank, on a holiday weekend, with a ransom note in its loan documents bucket and an attacker who had rewritten 61.3 million of its 286 million imaging objects under keys set to expire: contained in six days, nothing paid to the attacker, and no object the bank needed under the attacker’s keys when they expired.

Read the sample case study

Every report, by engagement and week:Wrenfield All samples

How much of Charles you get.

Hourly does not mean open-ended. The figure that stops the work is yours, and the authorization is a deposit.

The rate
$675 per hour

Any hour of any day, in 6-minute increments, in an hour log you can read. No premium for nights, weekends, or holidays, and no minimum blocks.

Not-to-exceed
Default 80 hours

Set by you at activation. Work stops at the figure until you extend it in writing, so the bill never gets ahead of your approval.

With a Retainer
$450 per hour

A Retainer holder pays the lower rate and has written response commitments. The 40 prepaid hours are for readiness work and do not pay for an incident. Without a Retainer, there is no response-time commitment.

Scope
  • One AWS organization of up to 50 accounts, every enabled Region, from activation to containment declared
  • Your other environments only as named sources of evidence
  • Containment, evidence preservation, the vault account where data is at risk, eradication of persistence, and the six reports
  • Counsel retains Vantalect and directs the work; you pay
What we need from you
  • Outside counsel who signs the engagement letter and the incident statement of work, both new for this incident, or your willingness to engage counsel at once. Without counsel we contract with you directly for operational work only, say in writing that privilege may not attach, and re-paper through counsel when counsel arrives
  • A named incident lead, and a named approver for every containment action
  • The incident role deployed from our template, which you read first, into the accounts in scope
  • Your broker told, so the insurer’s notice and consent run in parallel with stage 1
Access and authority

Every action approved,
logged, and reversible.

The engagement letter gives written authority to access your accounts and to take each containment action it names, within AWS’s customer agreement. Nothing is done on a hunch.

A role you can read

You deploy the incident role from a template Vantalect provides and you read first. You can see exactly what it allows.

Propose, approve, log

Vantalect proposes each containment action, a named approver of yours approves it, and it is logged with its rollback.

Capture before change

Before each action we capture and hash the state it will change, and log it with your approver’s approval. Nothing is destroyed unless you approve a specific destructive step in writing because waiting would do more damage.

No ransom role

Vantalect never contacts, negotiates with, or advises on paying an attacker, and never touches ransom funds. It does not hack back. Indicators go to counsel for sanctions screening.

No legal determinations

Reports say what the evidence shows and which regimes counsel may want to consider. They never say an incident is reportable, material, or not a breach.

Your evidence, then gone

We build the forensic account and evidence buckets for you, in your organization. You own and control them from the day they exist, and we hold only the investigator role. We retain our working copies until counsel authorizes destruction in writing after confirming preservation obligations. We then delete the authorized copies and provide a certificate on the agreed schedule.

The tools of the engagement.

Native AWS controls, a custody log, and an hour log.
Everything the engagement produces is left with you.

Containment

Service control policies

A deny-list policy on the affected unit stops destructive actions across every account in it at once, and comes off the same way.

Evidence

S3 Object Lock

The evidence account and its buckets are versioned and locked in compliance mode, so the copy of the logs cannot be changed, by anyone, for the retention you set.

Chain of custody

The custody log

Who collected each item, when, from which resource, how it was hashed, and every transfer, so counsel can authenticate the evidence.

Who does the work

Charles Sieg, personally, with the agents he directs. The sample engagements on this site are fictional. Vantalect is a consulting expert to your counsel, not a law firm, and its reports are not legal advice.

Questions a general counsel asks first

Do we need a lawyer first?

We contract through your outside counsel by default: counsel retains Vantalect for this incident to help counsel give legal advice, you pay, and we work at counsel’s direction. If you have no counsel at 1 AM, we still start. We contract with you directly for operational work only, write down only operational facts and give analysis orally, say in writing that privilege may not attach to what we do before counsel signs, urge you to retain counsel at once, and re-paper the engagement when counsel arrives.

Will you contact or pay the attacker?

No. We never contact, negotiate with, or advise on paying an attacker, and never arrange, send, or hold a payment. We give counsel the technical indicators, labeled as indicators, for sanctions screening. A client that decides to pay does so through counsel.

How fast can you start?

Without a Retainer there is no response-time commitment, because one consultant cannot promise one while he may be on a bridge for another client. Not yet offered: no incident phone number or mailbox is published. Round-the-clock response with commitments is a Retainer feature: a Retainer holder gets a written call-back and hands-on commitment, with service credits when we miss them.

What are the agents, and who sees our data?

Charles directs software agents (AI tools) that read, analyze, and draft under his supervision. He reviews every deliverable and verifies every finding. By default the agents work inside your forensic account and your own accounts. Evidence goes to any other provider or region only with the written consent of you and counsel for that incident, under terms that bar training on it and bar keeping it, and each working copy’s location is in the custody log. Pursuit, our tracker, reconstructs the attacker’s sessions from the recorded API calls; it runs in an account you own, and its case database stays there. We retain our working copies until counsel authorizes destruction in writing after confirming preservation obligations. We then delete the authorized copies and provide a certificate on the agreed schedule.

What if most of our evidence is outside AWS?

We say so on the first call and name the gap. We analyze the AWS side only, and read what you hand us from elsewhere. Laptops, on-premises networks, mobile devices, email tenants, and SaaS are outside the engagement.

Will our insurer cover this?

Many cyber policies expect a panel vendor or written consent for another. Ask your broker now to list Vantalect as a named non-panel provider. If it is not listed at activation, your broker requests consent in parallel with stage 1, and costs the insurer has not consented to may not be reimbursed.

Does AWS’s own incident response service replace this?

No. It works beside this one when you have it. Disk and memory forensics, a chain-of-custody record, and reports written for your counsel are what this adds.

When does it end, and what comes next?

When your incident lead declares containment in writing. Most clients then take the Investigation and the Recovery, which trace the attack and fix the root causes, or the Retainer, so the next incident starts with the role, the logs, and the paper already in place.

Is this legal advice?

No. Nothing Vantalect delivers is a legal determination.

What licenses and insurance does Vantalect hold?

Vantalect does not need a private-investigator license for this work. It carries errors-and-omissions insurance. It carries no cyber insurance and expects to need none. Liability is capped as the master services agreement sets out.

Three offers, one incident path.
Before, during, and after.

The Response runs while the attack does. The Investigation and the Recovery follow it, or start on their own for a breach found later. The Retainer buys back the first hour of the next one.

A long underground bank vault corridor receding into shadow, rows of closed steel deposit doors on both walls and a single beam of cool light across the polished floor.
AWS forensics · CloudTrail · recovery

AWS Breach Forensics & Recovery

You know you were breached. You don’t yet know how, what they touched, or whether they are still in.

Read the engagement
An empty stone-paved town square in front of a columned limestone civic building at pre-dawn after a storm, wet paving reflecting a clearing sky and one street lamp still lit.
AWS incident readiness · one year · prepaid hours

AWS Incident Response Retainer

When it happens, the first hour goes to finding a lawyer, signing paper, and creating a role. Spend that hour now.

Read the engagement

The five fixed-price engagements are separate: compare them on the home page. The incident offers are not bundle members.

Not yet offered.

Vantalect does not yet offer AWS Incident Response. No incident phone number or mailbox is published, and nothing on this page is an offer. If something in your AWS organization is deleting data now, call AWS Support and your own outside counsel.

Not yet offered.

AWS, Amazon Web Services, AWS Security Incident Response, and the AWS service names are trademarks of Amazon.com, Inc. or its affiliates. Vantalect is not affiliated with or endorsed by any of them.