Emergency Response
A critical vulnerability just dropped. Your team is scrambling. We are already working.
Sherlock Forensics provides zero-day emergency response services for organizations affected by newly disclosed vulnerabilities. Led by Ryan Purita (CISSP, ISSAP, ISSMP), the service includes emergency assessment with a 4-hour SLA starting at $2,500 CAD, full impact analysis within 24 hours at $5,000 CAD and custom remediation support. Established circa 2004 in Vancouver, BC.
When a zero-day hits, every hour counts. While your team is still reading the advisory, we are already mapping your exposure, checking for indicators of compromise and building a remediation plan. We have done this for Log4Shell. We have done this for MOVEit. We have done this for SolarWinds. We will do it for the next one too.
Response Tiers
Rapid triage within 4 hours of engagement. We identify whether your systems are affected, check for active exploitation and deliver an initial risk assessment with immediate mitigation steps. This is your first line of defense when a zero-day drops and you need answers fast.
Comprehensive analysis delivered within 24 hours. Includes full asset inventory, version mapping, indicator of compromise scanning, lateral movement assessment and a detailed report with prioritized remediation actions. We tell you exactly what is exposed, what may already be compromised and what to fix first.
Hands-on remediation for complex environments. Our team works alongside yours to patch systems, harden configurations, deploy mitigations and verify fixes. Scoped based on infrastructure size and vulnerability severity. Includes post-remediation validation testing.
Process
You contact us or we contact you. Our threat intelligence team monitors vulnerability feeds, vendor advisories and exploit databases around the clock. When a critical zero-day drops, we proactively reach out to clients who may be affected. Subscribers to our zero-day alert list receive notifications within minutes of disclosure.
We map your attack surface against the vulnerability. This means identifying every instance of the affected software, checking version numbers, reviewing configurations and determining which systems are internet-facing. For supply chain vulnerabilities, we trace transitive dependencies to find hidden exposure.
We check whether the vulnerability has already been exploited in your environment. This includes scanning for known indicators of compromise, reviewing logs for suspicious activity, checking for unauthorized file modifications and looking for persistence mechanisms that attackers commonly deploy after initial exploitation.
We deliver specific, actionable remediation steps prioritized by risk. For critical systems, we provide temporary mitigations that reduce exposure while permanent fixes are deployed. Every recommendation includes implementation guidance so your team can act immediately.
Track Record
December 2021. A remote code execution vulnerability in Apache Log4j affecting virtually every Java application on the internet. We began client notifications within 2 hours of public disclosure and completed exposure assessments for all managed clients within 48 hours. Multiple organizations had vulnerable instances they did not know existed in transitive dependencies.
May 2023. A SQL injection vulnerability in Progress MOVEit Transfer exploited by the Cl0p ransomware group. We identified affected clients, verified file transfer integrity and implemented network-level mitigations before the vendor patch was available. Zero clients experienced data exfiltration.
December 2020. A supply chain attack that compromised SolarWinds Orion updates to deliver backdoor malware to 18,000 organizations. We performed forensic analysis of Orion installations, identified compromised builds and guided remediation including full infrastructure credential rotation for affected clients.
Stay Informed
Get notified when critical zero-day vulnerabilities are disclosed. We send alerts only for high-severity issues that require immediate action. No spam, no marketing, just the vulnerabilities that matter.
Frequently Asked Questions
Emergency Response
Emergency assessments from $2,500 CAD with a 4-hour SLA. Call us or subscribe to zero-day alerts.
Call 604.229.1994Whether you are dealing with an active zero-day or want to establish a retainer for future incidents, we are ready to help.
Call 604.229.1994