Special Services • SP-10
Incident Response
When it has already happened, speed and evidence both matter.
Scope
What the engagement covers.
Personal and executive incidents combine account compromise, device intrusion, physical risk and reputational damage at once. Response has to work across all of them simultaneously.
Included capabilities
- Rapid triage across account, device, physical and reputational dimensions
- Threat isolation and account recovery under adversary pressure
- Lightweight digital forensics preserving evidence for later use
- Coordinated escalation to legal, law enforcement and platforms
- Post-incident hardening and control adjustment
Outputs and deliverables
- Incident timeline and scope assessment
- Forensic findings with preserved evidence
- Recovery confirmation and hardening record
- Post-incident report and control changes
Workflow
How it is delivered, step by step.
Each step has an owner, an entry condition and an artefact that has to exist before the next step begins.
01ActivateImmediate triage, containment priorities and command structure.
02ContainIsolate compromise, secure accounts and stabilize communications.
03InvestigateForensic collection preserving evidence and establishing scope.
04RecoverRestore secure access, harden and verify the environment.
05ReviewPost-incident report, control changes and monitoring adjustment.
Use cases
Where this is typically applied.
Extortion or blackmail involving personal data
Combined physical and digital targeting of a principal
Delivery model
The operating pattern for Special Services.
The same delivery discipline applies across every capability in this line, so combined engagements stay coherent.
Assess
Threat picture, exposure, routine analysis and protective gap review.
Harden
Identity, device, communication, physical and information-domain controls.
Monitor
Continuous intelligence, exposure detection and early warning.
Respond
Containment, recovery, investigation and coordinated escalation.
Review
Post-incident learning, control adjustment and periodic reassessment.
Integration
- Client corporate security, legal counsel and communications functions.
- Existing IT and identity teams for account and device remediation.
- Insurers, local providers and law enforcement liaison where authorized.
- Family office and household staff protocols for the personal perimeter.
Engagement approach
Every mandate is scoped in writing with a named sponsor, defined coverage hours and a stated legal basis. Discretion applies to method and reporting channel, never to whether the work is lawful, authorized and recorded.
Related
Other capabilities in Special Services.
SP-01
Executive Digital Protection
Protect the person, not only the corporate perimeter.
SP-02VVIP Close Protection
Physical protection planned from intelligence, not from habit.
SP-03TSCM
Confirm the room is not listening.
SP-04Counter-Surveillance
Detect the people watching before they act.
SP-05Threat Intelligence
Early warning built from sources the principal cannot monitor alone.
SP-06Dark Web Monitoring
Find the exposure before it is used.
SP-07Identity & Reputation Protection
Defend the name as carefully as the person.
SP-08Private Investigation
Lawful fact-finding that stands up when it is challenged.
SP-09Strategic Communications
Control the narrative before it controls the outcome.
SP-11Human Risk
The most reliable way in is still the person.
SP-12Clandestine Offensive Security
Adversary emulation run without warning the defenders.