3 critical advisoriesLiteLLM 1.107.0·PHP2Shell·GitLab CVE-2026-110264All advisories→

Incident response, on demand. Humans when you need them.

Our responders get on a call, sign an NDA, request the access and logs the incident needs, and work it to the root. You get actionable intel and recommendations fast. You don't need to be a customer: write to incident@vulneron.com.

IR-2026-031 · Suspected data exfiltration · NDA signedOkta session hijack to S3 exfiltration
Investigation live · T+3:10
Engagementclock starts at first call
  • Call with your teamT+0:00
  • NDA signedT+0:20
  • Access grantedT+0:45 · CloudTrail · Okta · EDR
  • Investigationsince T+0:45
  • Containment recommendations3 of 5 applied
  • Report and evidence packafter closure
Findings so far2 C · 1 H · 1 M
  • T+1:05CriticalInitial access: phished Okta session replayed from a new ASNj.doe@example.com · 198.51.100.23
  • T+1:40CriticalPersistence: new IAM access key created on svc-deployAKIA…7Q2F · contained, key revoked
  • T+2:25HighExfiltration: 14.2 GB read from s3://exports-prodGetObject burst · 41 minutes
  • T+2:50MediumMFA reset without helpdesk ticketrecommendation: require ticket ID
Evidence packdraft
  • E-01CloudTrail extractsha256 9f2c…a41e
  • E-02Okta system logsha256 41b7…0c9d
  • E-03EDR telemetry exportsha256 c08e…5f12
  • E-04Reconstructed timelinesha256 7a3d…e6b0
Chain of custody14 entries · 2 reviewers
Access: read-only · time-boxed · revoked at closeContained: session killed · key revoked · bucket policy tightened
Illustrative product view · sample data
How it works

From first call to closed incident. Five steps, no surprises.

The same practitioners who run our pentests and trained the Attack agent. They know how attackers move because they do it for a living.

  1. 01

    A quick call

    Tell us what you are seeing. We ask the questions that matter in the first hour and agree what happens next.

  2. 02

    NDA and scope

    We sign an NDA before we touch anything, and agree the scope and rules for the investigation.

  3. 03

    Access and logs

    We request the access, logs and exports the incident needs, and nothing more. Access is revoked when we close.

  4. 04

    Investigate and contain

    Responders reconstruct what happened and work with your team to contain it while the investigation runs.

  5. 05

    Intel and recommendations

    You get findings you can act on and prioritised recommendations, with a quick turnaround.

For regulated businesses

Evidence you can hand over. Organized, audited, accounted for.

When a regulator, an insurer or the police will ask questions, a slide deck is not enough. We assemble an audited evidence pack with a chain of custody, ready to share with law enforcement in case of cyber crime.

What you get

Answers you can act on. Not a report six weeks later.

Agents contain most incidents on their own. When one needs people, responders work in the same findings stream, so nothing they learn is lost when the incident closes.

FAQ

Incident response questions

Do we need to be a Vulneron customer?
No. Anyone can bring us an incident. Email the incident inbox and we will set up a call.
How fast do you respond?
Often within hours. Larger incidents can take up to a day. On the first call we agree a timeline for findings and recommendations based on the scope.
What access do you need?
Only what the incident needs, agreed on the call and after the NDA is signed. Typically read access to cloud, identity and endpoint logs or exports. Access is time-boxed and revoked when we close.
Can the evidence go to law enforcement?
For regulated businesses we prepare an organized, audited evidence pack with a chain of custody, ready to share with law enforcement, regulators and insurers. Whether and when to share it is your decision.
If the agentic SOC contains incidents, why would we need this?
Most incidents are contained by the agents without anyone waking up. Responders are for the rest: incidents from before Vulneron was deployed, ones that need forensic depth, or ones where a regulator or the police will want a report signed by people.

Something wrong right now? Write to us.

Email incident@vulneron.com with what you are seeing. We will get on a call, sign an NDA and start.