Incident response · Australia & New Zealand
Cyber incident response, Australia and New Zealand.
When something has gone wrong, you need someone who has seen it before. Authene responds to cyber incidents for organisations across Australia and New Zealand, 24/7/365. Email us and a responder replies within 15 minutes, tells you what to do in the next hour and stays with you until it’s resolved.
Response
15 minutes, 24/7/365
Coverage
Australia and New Zealand, on local time
Incidents
Email fraud, ransomware, cloud and web compromise, and more
You get
A one-page summary first, with the evidence behind it
If it’s happening now
Do this first.
- Don’t power off affected computers. Disconnect them from the network instead
- If money may have moved, call your bank now and ask for a recall
- Don’t delete emails, files or accounts, even suspicious ones. They are evidence
- Contact suppliers and customers on a number you already know, not one from a suspicious email
- If you have cyber insurance, follow your insurer’s incident process
- Email response@authene.com.au. A responder replies within 15 minutes
When you get in touch
Helpful to have ready.
Don’t wait to gather all of this. Send what you have and we’ll ask for the rest.
- What you noticed, and roughly when
- Which systems, accounts or people seem affected
- Whether any payment or data may be involved
- Your IT provider’s contact details, if you have one
- Your insurer and policy number, if you’re insured
Incidents we respond to
Whatever it turns out to be.
You don’t need to know what kind of incident it is before you get in touch. Working that out is our job. These are the ones we see most.
How a response runs
A calm, fixed sequence.
Every incident is different, but the order of work isn’t. It keeps decisions clear when the pressure is on.
Triage
A responder takes the facts and tells you what to do in the next hour.
Scope
We agree what needs answering, who needs to know and an estimate of the work.
Contain
The attacker’s access is cut off and evidence is preserved.
Investigate
We establish how they got in, what they did and what they touched.
Recover and report
A safe return to normal, and findings in plain English.
Working with your insurer
Built around the claim.
Most cyber policies have an incident process. We work within it, so the response and the claim move together.
- Early scoping and a clear estimate before the work grows
- Regular updates in a form claims teams can use
- Findings that separate what’s confirmed from what’s likely
- Ask your insurer about appointing Authene for your claim
Working with your lawyers
Evidence they can rely on.
Authene isn’t a law firm and doesn’t give legal advice. We provide the technical facts your legal counsel needs to advise you.
- We can be engaged through your lawyers if they ask
- Evidence preserved and documented from the start
- Clear answers to the questions counsel needs answered
- Reports written to stand up to review
What you get
Reports that lead with the answer.
Every report starts with a one-page summary for leadership. The detail sits behind it for the people who need it.
What happened
A plain-English account of the incident and a timeline of the attacker’s activity.
How they got in
The likely way in, so recovery doesn’t leave the door open.
What was affected
The accounts, systems and data involved, and what may have been taken.
What’s confirmed
Findings marked as confirmed, likely or unknown, so nobody overstates them.
What to fix
Practical next steps, ordered by what reduces risk most.
The evidence
The supporting detail your insurer, lawyers and IT team can check.
How pricing works
No surprises on cost.
The cost of a response depends on the incident, so we scope it with you before the work grows. Many cyber insurance policies cover incident response; check your policy or ask your insurer.
What drives cost
How many accounts, systems and locations are involved, how long the attacker had access and how much evidence there is to review.
How we estimate
After triage we agree the questions that need answering and give you an estimate. If the scope changes, we tell you before it does.
Getting it right first time
A contained, evidence-led response usually costs less than recovering twice. We focus effort where it changes decisions.
Before the next one
Responders already on standby.
An incident response retainer means no procurement or onboarding when something happens. We already know your environment, your people and your insurer, and we start straight away.
Get ready
Find the gaps while it’s quiet.
- Tabletop exercises for leadership and technical teams
- Compromise assessment to check nobody is already in
- Security hardening for email, identity and cloud
- Free resources, including the BEC first-hour checklist
Who we help
Built for everyone in the room.
Where we respond
Remote response, on your time zone.
Authene responds remotely across Australia and New Zealand, so there’s no travel time wherever you are.
Questions
Common questions.
What is cyber incident response?
It’s the work of stopping an attack, finding out what happened and getting back to normal safely. A good response contains the damage, preserves the evidence, answers the questions your leadership, insurer and lawyers will ask, and fixes the weakness that let the attacker in.
How quickly can Authene respond?
Email response@authene.com.au at any hour and a responder replies within 15 minutes, 24/7/365. That first reply tells you what to do in the next hour.
Do you respond across Australia and New Zealand?
Yes. Our responders work on Australian and New Zealand time and support organisations in both countries.
I’m not sure it’s an incident. Should I still get in touch?
Yes. Many incidents start as something that just looks odd: an unexpected login alert, a supplier asking about an invoice you didn’t send, or files that won’t open. It’s quicker to rule something out early than to clean up later.
How much does incident response cost?
It depends on the size and type of incident. After triage we agree what needs answering and give you an estimate before the work grows, and we tell you before the scope changes. Many cyber insurance policies cover incident response, so check your policy or ask your insurer. See how much incident response costs in Australia.
Will you work with my insurer and my IT provider?
Yes. We work within your insurer’s incident process and alongside your IT provider or MSP. Your IT provider keeps running your systems; we bring the investigation and incident experience.
Should we pay a ransom?
That decision belongs to your leadership, legal counsel and insurer, and it has legal and practical consequences. We give them the facts they need to decide: what was affected, what may have been taken and what recovery options exist.
Do we have to report the incident?
Some incidents must be reported, for example under the Notifiable Data Breaches scheme in Australia or the Privacy Act 2020 in New Zealand. Whether that applies is a question for your legal counsel. We establish the facts they need, such as whether personal information was accessed. Official reporting links are below.
Official help and reporting
Where to report, and who else can help.
These services are free. Reporting helps authorities warn others and, for payment fraud, can help with recovery.
Incident response
Something wrong? Start here.
Email us and a responder will reply within 15 minutes, 24/7/365. If you’re not sure it’s an incident yet, get in touch anyway.