For DFIR firms · Follow the sun
Follow-the-sun DFIR cover: your night shift, in our daytime.
When your team in the UK, the US or Canada signs off, Authene’s day is starting. Hand us the overnight work and we keep cases moving under your brand, then hand back before your morning stand-up. Evidence stays in the jurisdiction you need it in.
For
DFIR and incident response firms, MSSPs and SOCs in the UK, US and Canada
Cover
Your overnight is our working day
Brand
Yours. We work white-label
Data
Worked in virtualised environments, kept in its jurisdiction
How handover works
Close the laptop. We’ve got it.
A follow-the-sun shift only works if the handover is clean. We agree the format with you once, then run it the same way every night.
Your end of day
Your lead sends the handover: case status, what needs answering next, access and any client constraints.
We pick up
An Authene responder confirms the handover and starts work, in your tooling and your process.
Through your night
Analysis, timelines, containment support and report drafting continue while your team sleeps.
Urgent changes
If something can’t wait for morning, we follow the escalation path you set, including waking your on-call lead.
Your morning
A handback note is waiting: what we did, what we found, what’s next. Your team picks up without missing a beat.
What we can cover
The work that can’t wait for morning.
Live incidents
Keep containment and investigation moving overnight instead of pausing for twelve hours.
Analysis queues
Clear backlogs of mailbox, cloud, endpoint and log analysis so cases are further along each morning.
Reports and timelines
Draft reports and timelines overnight, ready for your review and QA at the start of your day.
Surge cover
Extra responders on your team when a major campaign hits your clients and the queue explodes.
Data sovereignty
Your data stays where it belongs.
- We work in virtualised, isolated environments, set up for each engagement
- Evidence is worked where you need it to stay: in your environment, or in one hosted in the region you choose
- We don’t copy evidence out of that environment unless you agree
- Access is limited to the responders on your case and follows your procedures
- When the work ends, environments and any working copies are removed as agreed
White-label
Your brand, your client.
- We work under your brand and write in your report template
- We never contact your client unless you ask us to
- We don’t pitch our services to your clients
- We’ll sign your confidentiality agreement before any case detail is shared
- We check for conflicts before we accept work
Why Australia and New Zealand
The time difference is the point.
Sydney is roughly 11 to 16 hours ahead of London, and 15 to 19 hours ahead of the North American coasts, depending on daylight saving. That puts our working day squarely across your night.
Instead of paying for a night shift or leaving cases parked until morning, you get experienced responders working in daylight, in English, to your standards.
Who it’s for
Firms that never really close.
Incident response and digital forensics firms, MSSPs and SOCs in the UK, the United States and Canada that need cover outside their own hours, for a busy period or as a standing arrangement.
You keep the client relationship and the advice; we provide the technical facts behind it.
Questions
Questions from overseas firms.
Where does our clients’ data go?
Where you need it to stay. We work in virtualised environments: either inside your environment, or one we set up in the region you choose. We don’t move evidence out of it unless you agree, and we follow your evidence-handling procedures.
Can you work under our brand?
Yes. We work white-label, in your report template and your process. Your client deals with you, not us, unless you ask us to join a call.
What hours do you cover?
Our working day in Australia and New Zealand falls across the UK and North American night, so it lines up with your overnight. For live incidents we agree escalation cover with you, so urgent work doesn’t wait.
How do handovers work?
We agree a simple handover format with you at the start: case status, what needs answering, access and constraints. You get a handback note before your morning, every time.
Can we use you only during busy periods?
Yes. Some firms want a standing overnight arrangement, others want cover during a surge. Both work. Tell us what you need and we’ll agree the scope.
How is it priced?
We agree the scope and effort before we start, per case, per block of work or as a standing arrangement, so there are no surprises.
Also useful
More for partner firms.
Follow the sun
Let your team sleep.
Tell us your time zone, the work you need covered and how you hand over. We’ll tell you honestly what we can take on.