# Incident readiness & response Canonical: https://www.web3sec.news/services/incident-response Provider: Raiders (https://www.web3sec.news/about) Prepare the decisions, access, and evidence your team will need when normal assumptions stop holding. ## Who this is for Founders, security owners, and engineering teams preparing for an incident or looking for scoped investigation and recovery support. Readiness and live response are different engagements. Before an incident, the work is to make ownership, access, escalation, and recovery decisions usable under pressure. During an incident, the work begins by establishing what is happening, what is at risk, and what can be safely preserved or contained. Availability, specialist needs, authority to act, and secure communication are confirmed directly. This service does not imply a staffed emergency hotline, guaranteed response time, or continuous monitoring. ### Diagram: Respond with evidence, ownership and feedback. Contain the consequence while preserving a usable record of what happened. ![The response loop moves from detection to evidence preservation and triage, containment, investigation, recovery, and lessons verified through follow-up controls. Evidence handling and communications have named owners throughout.](https://www.web3sec.news/diagrams/incident-response-loop.svg) [Full-size SVG](https://www.web3sec.news/diagrams/incident-response-loop.svg) · [PNG download](https://www.web3sec.news/diagrams/incident-response-loop.png) Original explanatory control model; not a reconstruction of private incident evidence. ## Outcomes - Replace vague escalation plans with named decisions, usable contacts, and rehearsed access to the systems that matter. - Separate confirmed observations from working hypotheses so containment and communication can be proportionate to the evidence. - Define recovery criteria and follow-up ownership instead of treating restored availability as proof that the incident is over. ## Scope - Readiness: readiness reviews covering assets, dependencies, responders, communication paths, access recovery, backups, emergency controls, and evidence retention. - Scenario rehearsal: tabletop exercises built around a realistic scenario such as a compromised deploy credential, unexpected privileged transaction, leaked secret, or tenant-data exposure. - Scoped investigation support: build an event timeline, correlate available logs and artifacts, assess competing hypotheses, and identify evidence gaps. - Recovery: containment and recovery planning that accounts for operational dependencies, credential rotation, trustworthy deployment inputs, and verification of affected systems. ## Process ### Establish authority and a secure channel For readiness, share the architecture, on-call arrangements, existing runbooks, and relevant recovery assumptions. For a live incident, start with a high-level situation summary and arrange a private channel before transferring logs, source, or sensitive artifacts. ### Preserve and decide Agree who can authorize actions and record material decisions. Capture relevant timestamps, log sources, and artifact provenance before changes erase context where practical. Evaluate containment options against ongoing harm, evidence loss, and recovery complexity. ### Recover and learn Set observable conditions for resuming operations and verify them on the affected environment. Produce a timeline with confidence levels, remaining questions, and assigned follow-up. An agreed follow-up session checks whether the important corrective actions were completed. ## Illustrative deliverables These describe possible work products, not past client findings or promised outcomes. ### Practical response playbook An actionable set of roles, escalation steps, evidence locations, and stop conditions. Illustrative example: what to do when a release token is exposed and a suspicious production deployment appears. ### Exercise or investigation record A concise decision log and timeline tied to the available evidence. Illustrative example: a tabletop reveals that the team cannot revoke a provider token without access to a former employee’s account. ### Recovery and improvement plan Prioritized work with owners, verification criteria, and unanswered questions. Recommendations distinguish immediate containment from durable improvements and optional further investigation. ## Boundaries - Live support is subject to explicit availability and scope agreement. Use your established emergency responders first during an active incident. - Legal advice, regulatory decisions, law-enforcement representation, insurance determinations, and guaranteed asset recovery are outside this service. Coordinate those decisions with qualified advisers. - Evidence handling, permitted access, retention, confidentiality, and authority to make production changes must be agreed. Never send seed phrases, private keys, passwords, or unrestricted credentials. ## Questions ### Can you help before anything goes wrong? Yes. A readiness review and tabletop can expose missing access, ambiguous decisions, and untested recovery assumptions without disrupting production. The exercise should end with changes assigned to real owners. ### What should an initial incident message contain? Briefly describe the affected system, observed behavior, when it began, current impact, and who is coordinating. Avoid publishing raw logs or secrets. Establish a private channel and confirm availability before relying on support. ### Will a postmortem name a root cause? Only when the available evidence supports it. A useful postmortem can explain the most likely sequence, alternative hypotheses, confidence levels, and missing data without turning uncertainty into a definitive attribution. [Discuss this work](https://www.web3sec.news/contact) · [Approach](https://www.web3sec.news/approach)