A CSIRT is a team specialised in preparing for and responding to cybersecurity incidents. It helps assess the attack, contain it, investigate and organise the return to normal operations.
CSIRT: incident response and cyber crisis management
24/7 incident response and crisis management. Our CSIRT assesses the threat, contains the attack and coordinates the return to normal operations.
Facing a cyberattack, or suspecting a compromise?
When an incident hits, every minute counts.
Our CSIRT supports Swiss organisations before, during and after a cybersecurity incident. Our experts assess the threat, contain the attack, run the technical investigations that decisions depend on, and coordinate the return to normal operations.
Our approach follows recognised incident-response practice, notably NIST SP 800-61 Rev.3 and the NIST Cybersecurity Framework 2.0, while taking into account leading European guidance and the operational context specific to each organisation.
Facing a cyberattack?
Our experts assess the situation and start containment without delay.
Get assistanceDetect. Respond. Recover.
A structured response to limit the impact of the incident, make the right decisions and secure the return to normal operations.
Assess
Identify the signs of compromise, triage the alert, measure the affected scope and prioritise the actions to take.
Contain
Containment of the threat, coordination of the teams, technical investigation and remediation decisions suited to the situation.
Strengthen
Return to normal operations, verification that the threat is eradicated, reporting of the findings and lessons learned to reduce the risk of recurrence.
Responding to a cyberattack in Switzerland: emergency intervention and FOCS reporting
The situations that trigger an intervention
The servers are encrypted
Qualification of the attack, containment, investigation, identification of the initial vector and support through recovery.
Data appears to have leaked
Identification of the data involved, analysis of the traces, assessment of the scope and preservation of the evidence needed for reporting.
A Microsoft 365 account is compromised
Analysis of the accounts, mailbox rules, suspicious sign-ins and the mechanisms used to divert correspondence or payments.
An intrusion is suspected
Search for the entry point, lateral movement, persistence mechanisms and the actions carried out by the attacker across the information system.
Respond to an incident, or monitor continuously.
One capability, two ways to engage it: a one-off intervention when the incident is already here, a continuous service to see the next one coming.
After incident response comes digital forensics
Incident response contains the cyberattack, limits its consequences and restores operations. Once the emergency is under control, another stage begins: understanding precisely what happened.
Our digital forensics practice runs the investigations needed to reconstruct the timeline of the incident, identify the actions carried out on the systems and collect the relevant evidence under conditions that preserve its integrity and evidential value.
Legal
Work through the data in a case file, review or challenge an expert report, sort privileged material and answer the technical questions raised by the parties.
Corporate
Investigate and trace a data leak back to its source, verify exfiltration by an employee and document the facts to support your internal decisions.
Individuals
A device suspected of being compromised, a malicious attachment or message, personal data lost: a technical examination to settle the doubt and recover what can be recovered.
Our vision
Vasco's vision, Head of Forensics & Incident Response Monitoring.
Detecting is not enough: we understand threats, act on them and stay with our clients until they are under control.
Frequently asked questions
The essentials about our CSIRT practice
Short answers to understand when and how to activate an incident response team.
As soon as a compromise is confirmed or seriously suspected: ransomware, data leak, intrusion, mailbox compromise or any abnormal behaviour requiring a rapid investigation.
A SOC monitors and detects threats continuously. A CSIRT takes over the response once an incident is confirmed or requires intervention. With Rempart, the two capabilities work together.
Our experts step in and support you on every type of incident, from ransomware, intrusions, data exfiltration and leaks to mailbox compromises, with an approach tailored to each environment.
Since 1 April 2025, certain critical infrastructures must report cyberattacks to the FOCS within 24 hours of detection. The exact scope depends on the status of the organisation and on the incident.
The CSIRT acts during the incident: assess, contain, decide and restore. Digital forensics is a separate practice that establishes the facts from the traces, reconstructs the timeline and documents the evidence under conditions suitable for internal or judicial use. The two teams hand over to each other when the situation calls for it.
Rempart is the SecuLabs managed SOC. It combines 24/7 monitoring, threat detection and triage, alert response and proactive threat intelligence to strengthen your security over time.
Let's talk about your cybersecurity challenges
Whether you want to strengthen your security posture, set up continuous monitoring or call on our CSIRT for support, our experts are available.