A forensic-depth investigation of your estate: is anyone in here now, was anyone in here before, and what did they touch.
A near miss, an odd alert or a departed admin has left a question nobody can answer: are we compromised?
Average eCrime breakout time is 29 minutes; the fastest recorded was 27 seconds (CrowdStrike Global Threat Report, 2026). Historical dwell time hides in systems nobody inspects.
Dormant persistence and compromised credentials survive rebuilds and password resets.
A clear compromise determination, active or historical, with supporting evidence.
Forensic timeline of observed activity mapped to MITRE ATT&CK, with attribution where possible.
Blast radius assessment: affected systems, accounts and data.
Prioritised containment, eradication and hardening roadmap.
Managed threat hunting findings from the full engagement window.
Full Falcon modules stand up in your own tenant under our CrowdStrike partner evaluation licensing, at no licence cost for the engagement. If you adopt the platform afterwards, the deployment already fits your environment.
Each gate is a checkpoint we pass together before the engagement moves on. Hover a gate for its exit criteria. Typical scope; calendar confirmed in the statement of work.
Engineering at A$2,000 a day, project management at A$1,500 a day for half a day each week. Pick the scope that sounds like you; we confirm it on the scoping call.
Indicative pricing at typical scope bands. Every engagement is confirmed as a fixed-price statement of work after a scoping call, so the number you sign is the number you pay. Falcon platform licensing for the engagement window is included at no cost under our partner evaluation licensing.