Cube Cyber prepares Australian organisations for cyber incidents and responds when they happen, incident readiness and retainers, breach investigation and forensics, and resilience uplift after the event. The organisations that recover fastest are the ones that decided who does what before the phone rang; we help you become one of them, and we answer the phone when you are not.
Dealing with an active incident?
Three situations bring organisations to this page:
Core capabilities & deliverables
Incident response retainers
Pre-agreed terms, contacts and playbooks with our responders, so when an incident hits, work starts immediately instead of with procurement. Retainer clients get priority response and responders who already hold their environment context.
Breach investigation and forensics
Digital forensics and investigation to establish what happened, what was accessed or taken, and whether the attacker is really gone, evidence handled to a standard that supports legal, insurance and regulatory processes.
Cyber resilience uplift
Post-incident improvement that converts an expensive experience into a stronger position, closing the exploited gaps, and hardening the architecture, detection and processes the incident exposed. Delivered by the same firm that can then design, test and monitor the fixes.
Containment and recovery
Hands-on technical response, isolating the threat, evicting the attacker, restoring systems in the right order and verifying integrity before reconnection, working alongside your team and providers.
Incident readiness
Response plans and playbooks built for your environment and obligations, and tabletop exercises that put executives and technical teams through realistic scenarios, because the middle of a breach is the wrong time to meet your plan for the first time.
Our response methodology follows four stages, aligned to NIST SP 800-61 and ACSC guidance:
Prepare
Plans, playbooks, retainers and exercises before anything happens, including clarity on legal and notification obligations so those calls are pre-scripted.
Respond and contain
Rapid triage, containment of the threat and stabilisation of operations, with communication cadence agreed so executives get facts instead of noise.
Investigate
Forensic analysis to establish scope, root cause and data impact, feeding accurate information to legal counsel, insurers, the board, and regulators where notification applies.
Recover and uplift
Staged restoration with integrity verification, then a structured post-incident review and resilience uplift, so the same door is not left open twice.
We support obligations including the Notifiable Data Breaches scheme under the Privacy Act, APRA CPS 234 incident notification for regulated entities, and SOCI incident reporting for critical infrastructure operators. Our responders hold certifications including GIAC GCIH, and work alongside legal counsel, insurers and cyber insurance panels as required.
Privacy ActAPRA CPS 234SOCI
GIAC GCIHFrequently asked questions
Call us on 1300 085 366. Do not switch off affected machines unless they are actively encrypting, powering off destroys volatile evidence, isolate them from the network instead. Preserve logs, start a timeline of what you know, and limit knowledge of response actions to people who need them, attackers sometimes watch email.
Pre-agreed commercial terms, escalation contacts, response playbooks and priority access to our responders, plus onboarding so we hold your environment context before anything happens.
Yes, routinely. Incident response runs alongside legal counsel (often under privilege), cyber insurers and their panels, and your existing IT providers. Our job is the technical truth of the incident, established and documented in a way all of those parties can rely on.
It depends on what was affected. The Notifiable Data Breaches scheme applies where personal information is involved and serious harm is likely; APRA-regulated entities have CPS 234 notification timeframes; critical infrastructure operators have SOCI reporting obligations. Our investigation establishes the facts those decisions depend on, and your legal counsel makes the call with accurate information.
Yes. Post-incident engagement is common, verifying the attacker is actually gone, investigating what was accessed, and running the resilience uplift that stops recurrence. A quiet network is not the same as a clean one.
We're here to help.
Talk to a practitioner, not a call centre. Tell us what you're trying to solve and we'll come back to you within one business day. If you're dealing with an active incident, call us directly.
Send us a message
Tell us what you're trying to solve and we'll get back to you within one business day.
We use the details you provide to respond to your enquiry. Your information is stored in our Microsoft 365 environment and handled in line with our Privacy Policy, which explains how to access or correct it and how to make a complaint.