2Atomic / Services / Incident response and forensics

// engagement · fixed scope

What actually happened, not what is easy to conclude.

We take the implant apart and hand you a root cause. No product subscription required.

Email us about an incident → Scope an engagement
Fixed scope, quoted up front
Reversed in house, not triaged from a feed
Timeline and indicators, not a black box
Standalone, no platform license
Incident timeline: each event with the evidence it rests on, and the indicators handed back A document page giving an incident as a timeline. Each row is one event with its time, what happened, and the artifact that evidences it. One row rests on a single log line and is marked as such. A closing section lists the indicators handed back for hunting. INCIDENT RESPONSE Timeline, and what each step rests on WHEN (UTC) WHAT EVIDENCE 04-11 02:14 Credential used from a new ASN auth log, VPN netflow 04-11 02:31 Agent installed as a launch daemon plist on disk, ES exec event 04-11 03:02 Archive staged in /tmp file on disk, hash recorded 04-11 03:19 Outbound to 185.147.34.11:443 ONE LOG LINE 04-11 06:40 Host isolated EDR action record HANDED BACK FOR HUNTING File hashes 6 Network indicators 4 Behavioral rules 2
Sample Incident timeline: each event with the evidence it rests on, beside the indicators handed back for hunting The shape of the hand-back, redacted. Yours carries your own findings.

What we do

In this order, because containment that runs ahead of understanding destroys the evidence you needed.

  • Scope. What is in, what is out, and which systems hold evidence about to expire. This is the hour where an incident is either bounded or quietly widened for a month.
  • Contain. Cut the adversary's access without cutting the record of how they got it.
  • Reverse what got in. We reverse it ourselves rather than matching a family name and moving on, because the family name does not tell you what it did to you.
  • Hand back a root cause and a fix, plus the variant question: if this class of bug let them in, where else does it live?

The case most responders are not set up for

When the thing that was compromised is an AI agent, the evidence is what it decided and on whose authority, not which binary ran.

When the compromised thing is an autonomous agent with credentials and tools, the question is not which binary ran. It is which actions it took, on whose authority, and whether the record can be trusted at all. We reconstruct the decision trail from telemetry you can check rather than from the platform's assurance that nothing happened. The same applies to a poisoned model or a tool graph an injection walked through.

What you get back

Timeline
Evidence-backed, per event
Root cause
The entry point, named
Indicators
To hunt the rest with
Malware analysis
Capabilities, persistence, C2
The fix
And the variant sweep
What we could not reach
Named, not omitted

Plus a walkthrough with your engineers, so the findings are handed over in person rather than only in a document.