Incident response service

Speed matters in an incident management program. Our cyberdefense consultants can help lead an investigation or supplement your internal cybersecurity team to help quickly respond to attacks and mitigate impact.

Man working at computer.


What our Incident Response services can do for you

  • Data breach prevention

    Proactive approach to data breach prevention. 

  • Mitigate security risk 

    Help mitigate security risk through comprehensive methodologies. 

  • Minimize impacts of breach 

    Well-established capability that helps minimize the impacts of a breach. 

  • Improves incident response

    Improve response to cyber breach effectively for minimal damage and fast recovery.

  • Quick analysis and recovery 

    Seasoned responders with repeatable and well-tested methods and procedures.  

  • All hands on deck approach 

    Our “all hands on deck” approach includes in-depth digital forensic analysis, breach, support and compromise detection.  


Comprehensive incident response programs to respond to today’s complex threats

Incident Management Program

Contact us for pricing

AT&T Incident Management Program service provides expert resources to assess and improve all stages of your incident management lifecycle helping to prevent or minimize operational losses due to undesired security events.

Contact us

Incident Response and Forensics

Contact us for pricing

AT&T has experts who can support or supplement your team when suspected unauthorized activities are detected with a full incident management program that includes: detection, triage, response, and containment and prevention planning.

Contact us

Features and highlights

Incident Response services that fit your business

Features Details
Incident Management program assessment  Our cyberdefense team will review relevant documentation using custom developed frameworks to perform gap analysis and propose remediation recommendations. 
Incident Management strategy and roadmap development  From the results of the gap assessment, we will develop a desirable future state for your incident management program with a roadmap that details relevant technology, process, and resources. 
Incident Response plan and playbook development  AT&T can develop a custom incident response plan for your organization based on the threat, regulatory, organizational, and cultural and technology realities. 
Incident Response and Forensics operations assessment  Upon an illegal activity identified within your systems, we provide a critical review of your current internal processes and procedures for handling incidents.  
Forensics and electronic discovery  This discovery offers a full spectrum of information system-focused investigative capabilities delivered by professionals experienced in commercial litigation matters and criminal investigative proceedings. 
Incidence Response retainer service  Our incidence response retainer allows you to establish the terms and conditions for providing services in the event of a security incident so you can have a trusted advisor on standby.  


Explore more about AT&T Incident Response Programs


AT&T Cybersecurity consulting provides Security Event Management—part of our Secure Infrastructure services—to help you identify and manage security incidents and events on your network.


Today’s enterprise networks feature multiple combinations of network devices, operating systems, databases, and appliances that require monitoring and managing. Our secure infrastructure services help consolidate and streamline the volume of data that your network devices generate so that you can efficiently identify and respond to security threats.


The key activities of the service include:


  • Log consolidation, alerting, and reporting
  • Intrusion detection and prevention
  • Network Access Connection (NAC) placement and tuning

These activities help to allow your organization to keep track of alerts to possible threats to your network.

The purpose of Incident Response and Forensics is to investigate security incidents.


AT&T Cybersecurity Consulting can provide pre-breach services including an incident response retainer. Alternatively, we can also provide post-breach services such as digital forensics.


In either case, during our investigation, we may work with various parts of your organization (including legal, IT, information security, compliance, business units, and risk managers) and offer insight into all affected parts of your business. In addition, we critically review your internal processes for handling events, incidents, and evidence. We present the results of our review in a gap analysis format that refers to industry best practices.


To address the security challenges and risks you may face either before or after an incident, we provide:


  • Incident response retainer services
  • Data breach simulations
  • Incident response and forensics program development
  • Forensics and electronic discovery
  • Breach investigation
  • PCI Qualified Incident Response Assessors (QIRA)

Incident response and forensics is designed to respond to incidents in a manner that helps to contains the damage and mitigate your future risk.

An event is a single piece of information describing one occurrence on the network among millions of others. One or more events may constitute an alert if certain conditions are met based on defined escalation and correlation rules. Events are derived from device logs.

An alert is a notification that an event or series of events of interest has taken place. Alerts are presented and can be managed via the threat manager portal.

Security incidents are defined as any adverse events that threaten the security of information resources. Security incidents can include, but are not limited to:


  • Unauthorized access
  • Denial of service
  • Malicious code and virus
  • Probes and scans
  • Device log feeds latency and/or failure

To clearly communicate an incident’s severity level and the impact to the customer’s environment, it is necessary for the threat manager Incident Response Process (IRP) to follow a standard clarification methodology. Threat Manager has adopted the US-CERT Incident Reporting Guidelines and assigned a “Severity” value to each of the categories.

The IRP provides well defined processes that are repeatable and simple to follow by all participants. It describes the tools used for tracking and reporting security incidents and defines responsibilities for different phases of the plan.

The threat manager portal will follow the notification and escalation procedures as configured by the customer. The primary method of incident tracking is through the case in the threat manager portal. This includes documentation of verbal conversations. The customer can log on to the business direct portal and access the threat management system at any time to review the latest updates on active cases.

Request info

To get sales help from a Business Solutions specialist, please complete this form.
RAI Form

Thank you

Thank you for contacting us about Incident Response. An AT&T Representative will contact you shortly to provide any additional information and answer any questions.

RAI Form Anchor

Your feedback will help us to improve AT&T Business so you continue to have a great experience when visiting us!

This survey is conducted by an independent company ForeSee for AT&T.

Yes, I’ll give feedback!