+31 10 799 0412

Incident response · adversary emulation · Rotterdam / Austin

We hold the line while you find out what happened.

Anneal is a 38-person response team. We are on your bridge within 40 minutes of the call, contain the intruder in the first hour, rebuild what they touched, and write the one account your board, insurer and regulator can each actually read.

Hotline answered by a responder, never a queue · 24/7/365

Live engagement · INC-2291

Credential theft → lateral movement

Logistics client · 2,300 endpoints · 3 sites

Active

Window T+00:38 → 01:10

  1. svc-backup disabled and every ticket it held revoked.
  2. 14 hosts isolated at the switch port, not only in the EDR agent.
  3. Outbound beacon to the command server sinkholed at the edge.
  4. Re-entry attempt over VPN refused — MFA fatigue push denied by on-call.
Hosts isolated
14 / 14
Attacker dwell
3 h 12 m
Egress after 03:22
0 MB

A real engagement, anonymised. Step through the phases with ← →.

How we respond

Heat, then patience. That’s what annealing is.

Metal is annealed by heating it fast and cooling it slowly, so it comes out tougher than it went in. An incident runs the same way: the first hour is all speed, the next week is careful, unglamorous work.

  1. 01 · first 40 min

    Bridge

    A senior responder joins your call, takes the timeline and says out loud what we’ll do in the next hour.

  2. 02 · first hour

    Contain

    Accounts disabled, hosts cut off at the switch, egress closed. We stop the bleeding before we study the wound.

  3. 03 · days 1–5

    Eradicate

    Every persistence mechanism found and pulled, every forged credential voided, every endpoint hunted.

  4. 04 · week 2

    Account

    One document, three readers: a board brief, an insurer’s chronology and a regulator’s notice, all agreeing.

Retainers

Know who picks up before you need them to.

Unused hours roll into a purple-team week, so a quiet year still leaves you harder to break into.

Selected: Sentinel · Bridge in 40 min, on site in 6 h · billed annually, cancel at renewal

Under attack right now?

Call. Don’t fill in a form.

+31 10 799 0412

EU · answered in Rotterdam

+1 512 555 0178

Americas · answered in Austin

← All skills