Handle incident response with agility

Speed matters in an incident management program. Our cyberdefense consultants can help lead an investigation or supplement your internal cybersecurity team to help quickly respond to attacks and mitigate impact.


What our Incident Response services can do for you

Data breach prevention

Proactive approach to data breach prevention.

Minimize impacts of breach

Well-established capability that helps minimize the impacts of a breach.

Quick analysis and recovery

Seasoned responders with repeatable and well-tested methods and procedures.

Mitigate security risk

Help mitigate security risk through comprehensive methodologies.

Improves incident response

Improve response to cyber breach effectively for minimal damage and fast recovery.

All hands on deck approach

Our “all hands on deck” approach includes in-depth digital forensic analysis, breach, support and compromise detection.


Comprehensive incident response programs to respond to today’s complex threats

Incident Management Program

AT&T Incident Management Program service provides expert resources to assess and improve all stages of your incident management lifecycle helping to prevent or minimize operational losses due to undesired security events.

Contact us for pricing

Incident Response and Forensics

AT&T has experts who can support or supplement your team when suspected unauthorized activities are detected with a full incident management program that includes: detection, triage, response, and containment and prevention planning.

Contact us for pricing

Features and highlights

Incident Response services that fit your business



Incident Management program assessment

Our cyberdefense team will review relevant documentation using custom developed frameworks to perform gap analysis and propose remediation recommendations.

Incident Management strategy and roadmap development 

From the results of the gap assessment, we will develop a desirable future state for your incident management program with a roadmap that details relevant technology, process, and resources.

Incident Response plan and playbook development 

AT&T can develop a custom incident response plan for your organization based on the threat, regulatory, organizational, and cultural and technology realities.

Incident Response and Forensics operations assessment

Upon an illegal activity identified within your systems, we provide a critical review of your current internal processes and procedures for handling incidents.

Forensics and electronic discovery 

This discovery offers a full spectrum of information system-focused investigative capabilities delivered by professionals experienced in commercial litigation matters and criminal investigative proceedings.

Incidence Response retainer service 

Our incidence response retainer allows you to establish the terms and conditions for providing services in the event of a security incident so you can have a trusted advisor on standby.


Explore more about AT&T Incident Response Programs

Solution Brief

Learn about our broad range of Incident Management services to help prevent operational losses (PDF).


AT&T Cybersecurity consulting provides Security Event Management—part of our Secure Infrastructure services—to help you identify and manage security incidents and events on your network.

Today’s enterprise networks feature multiple combinations of network devices, operating systems, databases, and appliances that require monitoring and managing. Our secure infrastructure services help consolidate and streamline the volume of data that your network devices generate so that you can efficiently identify and respond to security threats.

The key activities of the service include:

  • Log consolidation, alerting, and reporting
  • Intrusion detection and prevention
  • Network Access Connection (NAC) placement and tuning

These activities help to allow your organization to keep track of alerts to possible threats to your network.

The purpose of Incident Response and Forensics is to investigate security incidents.

AT&T Cybersecurity Consulting can provide pre-breach services including an incident response retainer. Alternatively, we can also provide post-breach services such as digital forensics.

In either case, during our investigation, we may work with various parts of your organization (including legal, IT, information security, compliance, business units, and risk managers) and offer insight into all affected parts of your business. In addition, we critically review your internal processes for handling events, incidents, and evidence. We present the results of our review in a gap analysis format that refers to industry best practices.

To address the security challenges and risks you may face either before or after an incident, we provide:

  • Incident response retainer services
  • Data breach simulations
  • Incident response and forensics program development
  • Forensics and electronic discovery
  • Breach investigation
  • PCI Qualified Incident Response Assessors (QIRA)

Incident response and forensics is designed to respond to incidents in a manner that helps to contains the damage and mitigate your future risk.

An event is a single piece of information describing one occurrence on the network among millions of others. One or more events may constitute an alert if certain conditions are met based on defined escalation and correlation rules. Events are derived from device logs.

An alert is a notification that an event or series of events of interest has taken place. Alerts are presented and can be managed via the threat manager portal.

Security incidents are defined as any adverse events that threaten the security of information resources. Security incidents can include, but are not limited to:

  • Unauthorized access
  • Denial of service
  • Malicious code and virus
  • Probes and scans
  • Device log feeds latency and/or failure

To clearly communicate an incident’s severity level and the impact to the customer’s environment, it is necessary for the threat manager Incident Response Process (IRP) to follow a standard clarification methodology. Threat Manager has adopted the US-CERT Incident Reporting Guidelines and assigned a “Severity” value to each of the categories.

The IRP provides well defined processes that are repeatable and simple to follow by all participants. It describes the tools used for tracking and reporting security incidents and defines responsibilities for different phases of the plan.

The threat manager portal will follow the notification and escalation procedures as configured by the customer. The primary method of incident tracking is through the case in the threat manager portal. This includes documentation of verbal conversations. The customer can log on to the business direct portal and access the threat management system at any time to review the latest updates on active cases.