COALITION INCIDENT RESPONSE
Get back to business with our trusted forensics expertise
Coalition Incident Response (CIR)* gives you the digital forensics and incident response (DFIR) team you need to take back control of your business.
THE CIR ADVANTAGE
Respond to incidents confidently
See how our affiliate — Coalition Incident Response (CIR) —delivers expert investigation and support
during the uncertainty of a cyber incident.
![CIR 1](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F6kKLy1jjWttIRLOcMVuZrI%2Fa9bc0ef19f61e798755d9f731771c361%2FIR-1.png&w=3840&q=75)
Experts with insurance experience
When engaged, the CIR team collaborates with an organisation's IT and response panel to help speed investigation and mitigate loss.
Advanced technology and threat intelligence
Depending on the type of incident, CIR can deploy advanced endpoint protection, detection, and response technology to assist customers. CIR also combines threat intelligence insights with proven forensics and analysis.
![CIR 2](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F6vU8v0GJv2PbGWsKrZmNdv%2F5f365d99bbfb1faf779092ab7c9f587f%2FIR-2.png&w=3840&q=75)
![CIR 3](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F68vTZhVJXiDraaEaA8C2hu%2F6e0b597468ac931a44eab0bc1d3c368c%2FIR-3.png&w=3840&q=75)
Limit potential incident costs
CIR can negotiate with threat actors when needed, and deploys the latest digital forensics and incident response (DFIR) tools, and partners with leading cybersecurity providers to help minimise costs and mitigate financial and data losses.
Enhanced cybersecurity services
CIR offers post-incident monitoring to improve a business’s security posture after an attack. CIR also offers add-on service options, including Managed Detection & Response (MDR), incident response (IR) Tabletop Exercises, Customised Security Assessments and more.**
![CIR 4](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F1FDrlYhGBciKmhkrf3bdk6%2F0d2eff40cc9583a9d39b7a4496b41d85%2FIR-4.png&w=3840&q=75)
Experience that minimises cost and maximises security
1000s
of incidents handled by CIR’s pressure tested and experienced experts
47%
of reported events handled with no cost to the policyholder1
44%
of ransom demands that resulted in payment were negotiated down by CIR1
+30 days
with CIR, policyholders can stay secure with at least 30 days of post-incident monitoring1
RESOURCES
Active Cyber Insurance is a unified approach to digital risk
![Incident Response: Prepare](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F2YRZfNmWais7kNXkll68bY%2Fd28466174839400b9011e40d519aca48%2FFrame_9.png&w=3840&q=75)
Prepare
Explore this primer on cyber incident response planning and guidance. See how the best way to prevent a cyber attack is to prepare for one.
![Incident Response: Respond](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4H9o3PsmFKAH1C1ruXlQNX%2F8847ab007604c0b8df4ef91f5e4ba5ea%2Frespond-thumbnail.png&w=3840&q=75)
Respond
Coalition’s claims team works closely with panel vendors, including CIR, to help policyholders recover.
![Incident Response: Secure](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F1QbNI2rLqZqaE1kkPGKDHv%2Fb0e008c2c3030990762e96d8476834b7%2FMediaContainer.png&w=3840&q=75)
Secure
Effective incident response doesn't stop with the investigation, see what services CIR can help a business after a cyber attack.
FAQ
What type of cyber incidents does Coalition Incident Response (CIR) handle?
CIR is one of several vendors that policyholders can engage in the event of a cyberattack, including ransomware, business email compromise, funds transfer fraud, network intrusion, web application compromise, and more. Policyholders also have access to pre–breach support with incident response planning and tabletop exercises.
What is “digital forensics and incident response”?
Think of digital forensics and incident response (DFIR) professionals as the first responders for cyber attacks. DFIR is a cybersecurity profession that focuses specifically on identifying how incidents occurred, investigating them as well as mitigating damage through expert remediation advice and services.
Can I use CIR if my business does not have a policy provided by Coalition?
Yes, CIR is an affiliate of Coalition that offers a myriad of cybersecurity services which are available to businesses even if they don’t have cyber insurance through Coalition Risk Solutions Ltd. Contact us today.
I have an internal IT team and a managed service provider, do I still need Digital Forensics and Incident Response (DFIR) in the event of a cyber incident?
Even the largest companies with well-funded security operations will often benefit from assistance from DFIR partners in the event of a cyber incident. That’s because most internal teams and Managed Service Providers (MSPs) have less day-to-day experience handling live incidents. For good reason, most MSPs primary responsibility is to make sure their client’s IT environment is operational and the defensive technology is configured correctly, maintained and monitored. Digital Forensics and Incident Response (‘DFIR’) on the other hand is a specialisation within the cybersecurity field that focuses primarily on investigating, containing and remediating cyber incidents. Because of this, when organisations want help handling cyber incidents, bringing in DFIR specialists is recommended.
Additionally, in the event of a cyber attack there may be legal considerations that your business needs to consider. If a business handles its own investigation, this could lead to improper handling or loss of evidence that is needed to fully conduct an investigation. Businesses that experience a cyber attack often hire an attorney to lead the investigation and direct the DFIR services vendor. This can help protect the business’ investigative findings in the event of litigation.
What are some things I can do right now to prepare my business for a cyber incident?
There are a lot of things businesses can and should do right now to be better prepared to respond quickly when a cyber incident is developing or when one strikes.
One of the most effective preparation measures for organisations of any size is a cyber incident response plan. There is tremendous value for an organisation in planning for a cyber incident to ensure internal stakeholders and decision makers have a trusted roadmap to guide them through the incident response process. The plan doesn’t need to be long or complex but it should be tested to make sure everyone involved knows their role and how they support the process.
We also recommend reviewing the Cybersecurity & Infrastructure Security Agency (CISA) guidance here. It’s organised by role, and provides clear and actionable recommendations for risk reduction. While it’s designed for small businesses, it’s applicable to organisations of any sizes and type.
For more complex organisations, we recommend using a more comprehensive framework such as the Center for Internet Security’s Controls, which can be customised to match your organisation’s risk profile. Many of these frameworks are free of charge and help internal teams handle the complexity of modern information security challenges. Learn more.
What is one recommendation to minimise the impact of ransomware on my business?
Maintain well-tested, routine, offline backups of critical business data. Businesses can avoid paying a ransom demand or losing data by implementing and testing offline backups so that in the event of a ransomware incident, restoration of such data is possible without the need to pay the cyber criminal’s demand.