Prepare
Roles, scenarios and decisions.
Prepare the company to act without improvising
Define who decides, what must be preserved and how to contain an incident without unnecessarily increasing disruption.
Client situation
The plan must work when communication, operations and evidence are under pressure.
Without predefined roles, evidence and criteria, containment can increase downtime or destroy important signals.
What Bellot reviews
We look at the real environment, not a generic checklist.
- Plan, roles and authority
- Telemetry and forensic readiness
- Highest-consequence scenarios
- Isolation and recovery routes
What you receive
Clear outputs your team can use.
- Plan and escalation matrix
- Scenario runbooks
- Tabletop with gap record
- Investigation report when applicable
How the engagement works
A controlled path from context to operational capability.
Exercise
Test coordination under pressure.
Contain
Reduce impact and preserve evidence.
Improve
Remediate cause and detection.
Engagement modes
Assessment, engineering or continuous evolution, each with a different commitment.
Assessment
Diagnosis, evidence and prioritized plan.
Engineering project
Implementation, validation and technical transfer.
Continuous evolution
Review, tuning and improvement in defined cycles.
Harpia / Operational role
AI expands analysis. Authority stays explicit.
In authorized environments, Harpia supports timeline correlation and evidence organization; containment remains under human authority.
What we need from the client
- Sponsor and key representatives
- Procedures and architecture
- Authorization and chain of custody
Boundaries and exclusions
- Emergency response depends on agreement and availability
- Does not replace legal counsel or public authority
- Blocking requires explicit authorization
Complementary modules
- Tabletop
- Forensic readiness
- Ransomware runbooks
- Controlled automation
When to engage
Bring Bellot in when the next defensive decision requires evidence.
No tested plan
Low downtime tolerance
Insufficient technical and executive readiness
Scope, access and operating boundaries are confirmed before work begins.
Test my incident readiness