DATA BREACH & INCIDENT RESPONSE SERVICES
Data Breach & Incident Response
Built on Evidence.
Cyber Centaurs investigates data breaches and cybersecurity incidents to determine what happened, establish scope, preserve critical evidence, and provide organizations and counsel with defensible findings for response and recovery decisions.
(877) 259-0509
24/7 Incident Response
WHEN TO ENGAGE
When the Facts Are Still Developing.
Incident response often begins before the full scope of a compromise is known. We help establish what happened, what was affected, whether unauthorized access or data loss occurred, and what evidence should be preserved.
Ransomware & Extortion
Data Breach / Unauthorized Access
Business Email Compromise
Cloud & Microsoft 365 Compromise
Endpoint / Server Compromise
Suspected Data Exfiltration
RESPONSE OBJECTIVES
Stabilize the Incident.
Establish the Facts.
Incident response requires coordinated action. The immediate priorities are to reduce ongoing risk, preserve critical evidence, determine what occurred, and establish the scope and impact of the incident.
Stabilize
Reduce immediate risk and establish operational control without unnecessarily disrupting the environment.
Preserve
Protect volatile and relevant evidence before remediation or recovery activity alters the record.
Investigate
Determine initial access, affected systems and accounts, threat activity, persistence, and the sequence of events.
Establish Impact
Define what systems, accounts, and data were affected and provide findings that support response and recovery decisions.
INVESTIGATIVE CAPABILITIES
Evidence Across the Environment.
Cyber Centaurs examines evidence across endpoints, identity systems, cloud environments, network telemetry, and data sources to reconstruct activity, determine scope, and establish defensible findings.
Endpoint & Server Forensics
Execution history
Persistence
Event logs
User activity
File system artifacts
Forensic timelines
Identity & Authentication
Account compromise
Authentication activity
MFA events
Privilege changes
Identity-provider logs
Microsoft 365 & Cloud
Exchange Online
Entra ID
SharePoint
OneDrive
Cloud audit activity
Mailbox configuration
Network & Security Telemetry
Firewall
VPN
DNS
Proxy
EDR / XDR
Network security logs
Data Access & Exfiltration
File access
Cloud transfers
External sharing
Removable media
Archive creation
Suspicious transfer activity
Evidence Preservation
Forensic acquisition
Volatile evidence
Log preservation
Cloud evidence collection
Chain of custody
INCIDENT RESPONSE PROCESS
Controlled Response. Defensible Findings.
Our response process is structured to preserve evidence, establish the sequence of events, determine impact, and provide clear findings for technical, executive, and legal decision-makers.
01
Triage & Scope
Establish immediate priorities, known indicators, affected systems, and the initial investigative scope.
02
Stabilize & Preserve
Reduce ongoing risk while preserving volatile evidence, relevant systems, logs, and other investigative sources.
03
Collect & Analyze Evidence
Acquire and examine endpoint, identity, cloud, network, email, and other relevant evidence.
04
Correlate & Determine Impact
Reconstruct activity across evidence sources to determine what occurred, what was affected, and whether data was accessed or removed.
05
Report & Advise
Present clear findings, identified impact, remaining risk, and practical recommendations for response and recovery.
INVESTIGATIVE FINDINGS
From Technical Evidence to
Decision-Ready Findings.
The objective is not simply to collect technical artifacts. Cyber Centaurs correlates available evidence to establish findings that help organizations and counsel understand the incident, evaluate impact, and determine appropriate next actions.
How Did the Incident Begin?
Identify evidence of initial access, compromised credentials, exploited systems, malicious execution, or other entry activity where supported by the available record.
What Systems or Accounts Were Affected?
Determine the endpoints, servers, identities, mailboxes, cloud resources, and other systems implicated by the evidence.
What Did the Threat Actor Do?
Reconstruct relevant activity, including access, execution, persistence, privilege changes, lateral movement, and other actions.
Was Sensitive Data Accessed or Removed?
Evaluate evidence of file access, staging, archive creation, cloud transfer, external sharing, or other potential exfiltration activity.
What Is the Supported Scope and Impact?
Correlate evidence across sources to distinguish confirmed findings from unresolved questions and determine the defensible scope of the incident.
What Should Happen Next?
Provide evidence-based findings and practical recommendations to support containment, recovery, remediation, legal, regulatory, and business decisions.
WHY CYBER CENTAURS
Technical Depth.
Investigative Judgment.
Incident response decisions are only as reliable as the evidence and analysis behind them.
Cyber Centaurs combines cybersecurity expertise, digital forensics, and investigative discipline to help organizations and counsel understand complex incidents, evaluate the evidence, and make informed response and recovery decisions.
Cybersecurity & Digital Forensic Expertise
Deep technical capability across endpoint, identity, cloud, network, and digital evidence sources.
Evidence-Driven Investigation
Findings are developed through collection, analysis, correlation, and validation of available evidence rather than assumption.
Support for Leadership & Counsel
Technical findings are communicated clearly to executives, legal counsel, insurers, and other stakeholders involved in the response.
Defensible Findings
Investigative conclusions are documented with attention to evidentiary integrity, technical support, and the questions decision-makers need answered.
INCIDENT RESPONSE FAQ
Practical Questions
Before Engagement.
Organizations often contact Cyber Centaurs while an incident is still developing and important facts remain unknown. These questions address common considerations at the beginning of a data breach investigation or incident-response engagement.
When should we contact an incident-response firm?
Contact Cyber Centaurs as soon as a suspected compromise could require investigation, evidence preservation, or coordinated response. Early involvement can help identify relevant evidence sources before logs, volatile data, user activity, or remediation efforts alter the available record. You do not need to know the full scope of the incident before contacting us.
Should we shut down affected systems before contacting you?
Not automatically. Shutting down, rebooting, reimaging, or otherwise modifying a potentially affected system can alter or destroy useful evidence. If immediate containment is required, take reasonable steps to reduce ongoing risk, but avoid unnecessary changes to relevant systems until evidence-preservation considerations have been evaluated.
Can Cyber Centaurs begin a data breach investigation remotely?
Yes. Many incident-response and digital forensic investigations can begin remotely through secure evidence collection, endpoint acquisition, cloud and identity logs, email data, security telemetry, and other available sources. On-site collection can be arranged when the circumstances or evidence require it.
Can you investigate Microsoft 365 or cloud account compromise?
Yes. Depending on the environment and available evidence, an investigation may include Microsoft 365, Exchange Online, Entra ID, authentication activity, mailbox configuration, audit records, cloud storage activity, and other relevant cloud evidence. The objective is to correlate those sources with endpoint and security telemetry where available.
Can you determine whether data was accessed or exfiltrated?
We evaluate available evidence for indicators of data access, staging, archive creation, cloud transfers, external sharing, removable-media activity, and other potential exfiltration behavior. Whether data access or removal can be conclusively established depends on the evidence retained by the affected environment, so findings are reported according to what the available record supports.
What evidence should we preserve after a cyber incident?
Relevant evidence may include affected endpoints and servers, identity and authentication logs, Microsoft 365 or cloud audit data, email records, firewall and VPN logs, EDR or security telemetry, file-access records, and other systems associated with the incident. Avoid unnecessary deletion, reimaging, log clearing, or configuration changes until preservation priorities have been considered.
Do you work with legal counsel, cyber insurers, and other incident-response stakeholders?
Yes. Cyber Centaurs can coordinate investigative work with internal or outside counsel, executive leadership, IT teams, managed service providers, cyber-insurance stakeholders, and other authorized participants. Technical findings can be communicated according to the needs of the response team while preserving clear investigative boundaries.
How quickly can an incident-response investigation begin?
Cyber Centaurs maintains availability for urgent cyber incidents and can assess initial investigative priorities during the engagement process. The specific start time and response requirements depend on the circumstances, scope, evidence sources, and resources required for the matter. For an active incident, call (877) 259-0509 or submit a confidential inquiry.
CONFIDENTIAL INQUIRY
Speak With an Investigator.
If your organization is responding to a suspected data breach or cybersecurity incident, tell us briefly what occurred and the assistance you need. A member of the Cyber Centaurs team will review your inquiry and follow up directly.
Confidential inquiry. Please do not submit evidence, credentials, or sensitive files through this form.