UC Threat Intelligence

​UnknownCyber Incident Response Plan Validation

Validate your organization’s Incident Response Plan or start with our template that incorporates UnknownCyber’s proactive defense.

An Incident Response Plan is a written document, formally approved by the senior leadership team, that helps your organization before, during, and after a confirmed or suspected security incident. Your Incident Response Plan will clarify roles and responsibilities and will provide guidance on key activities. It should also include a list of key people who may be needed during a crisis.

At a minimum establishing an incident response capability should include the following actions:

• Creating an incident response policy and plan
• Developing procedures for performing incident handling and reporting
• Setting guidelines for communicating with outside parties regarding incidents
• Selecting a team structure and staffing model
• Establishing relationships and lines of communication between the incident response team and other groups, both internal (e.g., legal department) and external (e.g., law enforcement agencies)
• Determining what services the incident response team should provide
• Staffing and training the incident response team

Please ask about our State and Local Cybersecurity Grant Program Resources to help you access federal funding to protect our critical infrastructure.

UnknownCyber Incident Response

Bad News Doesn’t Get Better With Time:

Hunting for intrusions involves proactively searching for evidence of cyber intrusions and then remediating any issues quickly so you can eradicate threats sooner and prevent further damage to your organization.

Identify/Contain:

When hunting leads to detection, Incident Response activities can help minimize data loss, mitigate vulnerabilities, and restore compromised services. When an incident occurs, the incident response team assesses the target and scope of the attack, and any vulnerabilities enabling it. Once an incident has been detected and reported—and the evidence collected—the threat must be contained to prevent it from spreading through the organization’s network and critical infrastructure.

Investigate/ Eradicate:

With UnknownCyber Incident Response investigations are accelerated allowing organizations to declare incidents earlier and win the time fight. Proaction reduces the risk of ransom, data exfiltration, and compliance penalties. UnknownCyber’s Incident Response Services deliver the critical factors of speed and accuracy to minimize incident-caused damage and limit the potential for further harm. UnknownCyber provides these services right-sized for organizations that wish to hunt but do not have a security team with the tools and specialized skillsets needed for a declared incident. With UnknownCyber you receive a marked advantage in eradicating the adversary beyond other threat intelligence and traditional IoCs because UnknownCyber provides an unmatched ability to detect new variants through code despite years of obfuscation. This augments traditional investigation and eradication allowing the removal of threats unknown to other solutions.

Recovering/ Restoring:

UnknownCyber’s Incident Response Services specialize in getting your organization back to its business. Downtime can have fatal impacts on revenue when businesses are unable to service customers for days. The average downtime after a ransomware attack is 22 days and the cost of this downtime averages $53,000 per hour. It pays to hunt early!

Downtime alone is motive enough for the PRC’s attacks on critical infrastructure. FBI Director Wray describes these attacks as “lying in wait for the moment China might choose to use their access to hurt American civilians.” CISA Director Jen Easterly echoed, “the threat is not theoretical, as CISA teams have found and eradicated Volt Typhoon intrusions into critical infrastructure across multiple sectors. And that’s likely “the tip of the iceberg.”

PRC hackers are positioning on American infrastructure in preparation to wreak havoc and create domestic confusion. Best practices would compel any fiduciary to advise their organizations to adopt proactive tools, now economically feasible through UnknownCyber’s automation, to hunt, assure, and eradicate today. This to ensure that if an incident has already occurred infrastructure operators know in sufficient time so they can restore the affected systems to their pre-incident state in an orderly environment with the least impact to their business processes. Douglas McArthur’s words to avoid failure ring true today. ‘Too late.’ Too late in comprehending the deadly purpose of a potential enemy. Too late in realizing the mortal danger. Too late in preparedness.”

Get Ahead of the Adversary!

Please ask about our State and Local Cybersecurity Grant Program Resources to help you access federal funding to protect our critical infrastructure.

​UnknownCyber Managed Services

UnknownCyber offers annual or monthly subscriptions to Managed Services. Customers can add UnknownCyber’s subscription services to their existing solutions and pivot to proactive protection against unknown threats that get passed other defenses. With UnknownCyber in your security stack you continuously hunt for network intrusions and stay ahead of the adversary using the detections from your other managed services to sense and harden against attackers that are learning from their own failed attacks to penetrate your defenses. UnknownCyber’s subscription services create customized signatures for proactive predictive protection from the actual threats that are targeting your organization’s infrastructure. This custom threat intelligence is delivered along with curated industry wide proactive hunts to provide the best intelligence for a proactive defense at a scale that cannot be achieved with human analysis.

Get Ahead of the Adversary and own the Unknown!

Please ask about our State and Local Cybersecurity Grant Program Resources to help you access federal funding to protect our critical infrastructure.