The whole incident: rehearsing it before it happens, finding out what happened and stopping it when it does, and getting the business running again afterwards. Systems, people, and the agents and automations acting on their behalf.
Technical containment is half of an incident. The other half is that a dozen people need to make decisions at once (legal, communications, the board, sometimes a regulator) and most of them cannot read a forensic report. Whether anything was actually reached, and whether it held personal data, is among the first questions we answer, because that is what starts a notification clock and it needs evidence rather than an assumption. We do both halves: our forensics team works the technical side while an incident manager sits in your crisis committee and keeps everyone working from the same picture. An AI system can be what caused an incident, what an attacker came through, or what was damaged. Those are three different investigations and we run all three. When it is over we write down what happened and what to fix first.
Both lanes run from the same first hour. The columns are deliberately unequal: the first hour holds more decisions than the first week, and an even grid would say otherwise.
The columns are not equal width. The first hour carries more than the first week.
Call us and you reach people who do this for a living, in five countries, at any hour. Support is in English. We are part of the Allurity group, so alongside our sister companies CSIS and Securix there is enough capacity to run a large incident around the clock.
An incident involving an AI system arrives in one of two shapes. Either something crossed your estate at machine speed, or your own agent reached a system it should not have and the operator of that system is on the phone. Both turn on records that either exist before the incident or do not exist at all: which tool an agent called, under which identity, what an automation did with it, and how long any of that is kept. We ask for those on the first call. Where they are missing, the report says so instead of filling the gap.
Responders reach for a model to read malicious code and command-and-control artefacts. A provider’s safety guardrails cannot always tell a responder from an attacker, and a model that declines mid-incident is a dependency nobody planned for. Which of your approved models answers that kind of request, and what your responders do when none of them will, is a question with an answer before an incident rather than during one.
The Black Basta ransomware reused the same 64 bytes of XChaCha20 keystream instead of advancing it, which left the encryption open to a known-plaintext attack. We reverse-engineered a sample, worked out a recovery method and built a decryptor. Files between 5,000 bytes and 1GB could be recovered in full. It went to victims, CERTs, DFIR providers and law enforcement before we presented it at 37C3.
How
A sample was reverse-engineered during casework, the keystream reuse identified, and a recovery method built and tested against real encrypted files before release.
What it does not support
It worked against one family, and only against the flawed version of it. It says nothing about ransomware in general.
Since
The flaw was corrected by the group in December 2023. The decryptor remains useful only for files encrypted before that.
Black Basta Buster: decrypting files without paying the ransomFour shapes these engagements take. Three of them start with a call. The fourth is the one that happens before there is anything to call about, and it is where a retainer’s unused hours go.
We work out whether anyone got in, how, what they reached, and whether they are still there.
One of our incident managers joins your crisis committee and runs the response alongside you.
After the incident is closed we go back over it properly and fix what let it happen.
Your crisis management team works a scripted incident for about four hours, with observers in the room.
Also available: a crisis simulation for a whole organisation — one hour, two speakers playing the attacker and the defender, the audience in the CISO role voting on each decision and the story branching on the result. A ransomware preparedness assessment, which reads each of the six stages of a ransomware attack against NIST CSF 2.0. An incident response retainer, where hours not spent on an incident convert into tabletop exercises. Continuous threat intelligence, which is what keeps a scenario current against how attacks are actually being run.
The first call is about scope: what you are seeing, what is still running, and what you have already done. Containment and investigation then run in parallel, because waiting for a complete picture costs more than acting on a partial one. What we know and what we do not yet know stay on separate lists. Sometimes the investigation produces something reusable: the Black Basta keystream reuse was found during casework and became a decryptor that went to victims, CERTs and law enforcement before we presented it. Where an agent or an automation is in the picture we work from its tool-call record rather than from its output, because the output is what it said and the tool call is what it did. Nothing goes to the board through us that we have not verified.
Tell us what you are building and what you need looked at. You will get an answer from the people who would run the engagement, and if another firm is the better fit for what you are asking, we will name one.
Security Research Labs is a member of the Allurity family. Learn more(opens in a new tab)