Root Cause Analysis (RCA)
Post-breach forensic inspection to locate exact entry vectors, logic bypasses, and initial compromised accounts.
Last reviewed by Rhitik Kumar, Lead Offensive Security Engineer.
Scope of Assessment
After an incident, root cause analysis reconstructs the timeline. Event log analysis locates the entry point, maps lateral movement and identifies the changes that prevent re-compromise.
Engagement Details
How the engagement runs
- 01
Immediate scoping and evidence preservation
We establish what is known, what is still running and what must be preserved. Volatile evidence is captured before anything is rebuilt or wiped.
- 02
Timeline reconstruction
Authentication records, application logs, endpoint telemetry, cloud audit trails and network data are correlated into a single timeline of what happened and when.
- 03
Entry vector and blast radius
We identify the initial access point, the accounts and systems the attacker touched, what was accessed or exfiltrated, and whether persistence remains.
- 04
Reporting and hardening
You receive a factual incident narrative suitable for management and, where required, regulators — plus the specific changes that close the path used.
What you receive
- Incident timeline reconstructed from correlated log sources
- Initial access vector with supporting evidence
- Affected account and system inventory
- Indicators of compromise for your detection tooling
- Hardening roadmap targeting the path that was used
Frequently Asked Questions
Do you assist in incident response?
Yes. Our forensic engineers work with containment leads to find initial access points quickly.
How fast can you start?
Root cause work begins as soon as scope and authorisation are confirmed. For an active incident, use the emergency line rather than the contact form.
What if our logging is incomplete?
It usually is. We work with what exists — endpoint artefacts, cloud audit trails, backups — and state plainly where evidence gaps prevent a firm conclusion rather than guessing.
Will the report hold up for regulators or insurers?
Reports are written to be factual and evidence-backed, with findings separated from inference, which is what both audiences require.
Related security services
Let's map out your testing strategy.
Have a custom compliance framework or specific targeting parameters? Schedule a scoping session with our senior offensive leads.