Threat Hunting
Proactively search your environment for attacker activity that existing detections have missed.
Learn moreEmergency response to active breaches: containment, eradication, recovery, and forensic investigation conducted with defensible evidence handling. Engage us immediately during an incident, or secure readiness ahead of time with an incident response retainer.
Digital Forensics and Incident Response (DFIR) is the discipline of responding to a live security incident while preserving the evidence needed to understand it. When an attacker is inside your environment, two objectives run in parallel: stop the harm, and capture a defensible record of what happened. Done well, the two reinforce each other rather than compete.
Our team works to a structured lifecycle, from the first triage call through containment, eradication, and recovery, to a root-cause report and the hardening that stops the same incident recurring. For organizations that want to shorten response time, an incident response retainer puts a named team, agreed terms, and pre-aligned procedures in place before the alarm sounds.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For incident response, that translates into a disciplined lifecycle, with evidence integrity maintained at every step.
Our response process and analysis are anchored to recognized incident response and adversary frameworks, so the work is structured, repeatable, and defensible.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
Yes. If you are facing an active breach, ransomware, or a suspected compromise, contact us by phone or WhatsApp and we will begin triage as a priority. Emergency engagements can typically start within hours of agreeing terms, with containment as the immediate goal.
An IR retainer is an arrangement made in advance, so a named response team, agreed commercial terms, and pre-aligned procedures are ready before an incident occurs. It removes negotiation and onboarding delay at the worst possible moment, shortening the time from detection to containment.
For emergency engagements, response typically begins within hours of agreeing terms and access. Retainer clients benefit from pre-aligned procedures and priority mobilization, which further reduces the time to begin containment.
We acquire and handle evidence with a documented chain of custody and integrity controls, following recognized practice so findings can withstand scrutiny. Whether evidence is ultimately admissible in a given proceeding is a legal determination, and we work alongside your legal counsel to support their requirements.
Yes. We help contain the spread, assess the scope of encryption and any data exfiltration, preserve evidence, and support a safe, validated recovery. We do not advise on or facilitate ransom payment, which carries legal and practical risks, and we focus on restoring operations securely.
Yes. The incident timeline, forensic findings, root-cause analysis, and the executive briefing are available in both Arabic and English at no additional cost.
Proactively search your environment for attacker activity that existing detections have missed.
Learn moreHarden infrastructure and architecture so incidents are harder to start and easier to contain.
Learn moreReduce human-factor incidents and prepare your team to report and respond effectively.
Learn moreWhat NCNICC and the PDPL require, and a plan a small company can actually run in the first hour.
Read the articleIf you are dealing with an active breach, contact us now and we will begin triage as a priority. If you want readiness ahead of time, talk to us about an incident response retainer.