Breach Investigation & forensics

Cube Cyber investigates cyber incidents and breaches for Australian organisations, digital forensics that establishes what happened, how the attacker got in, what was accessed or taken, and whether they are actually gone, with evidence preserved properly and findings reported in terms decision-makers can act on. Accurate facts are the foundation of every decision a breach forces: containment, notification and recovery all depend on knowing, not guessing. Dealing with an incident?

Call 1300 085 366

KEY CHALLENGES

Investigations answer the questions incidents make urgent:

Nobody knows the blast radius

Nobody knows the blast radius, systems were encrypted or an intrusion was detected, and the questions that determine everything, what did they touch, what did they take, how long were they in, currently have answers that begin with probably.

Evidence is being destroyed

Evidence is being destroyed by the response, well-meaning rebuilds, reboots and cleanups are overwriting the forensic record hour by hour, and with it the ability to ever establish scope, or to defend decisions later.

Every stakeholder needs different facts

Every stakeholder needs different facts, the technical team wants scope and cause, the regulator wants notification-grade certainty about personal information, and the board wants to know if it is over, one investigation has to serve them all, credibly.

WHEN TO ENGAGE

Immediately, when an incident is live, early engagement preserves volatile evidence and shortens everything that follows. But investigation is not only for emergencies: engagements routinely begin after the event, verifying an attacker is really gone from a quiet network, establishing what a discovered intrusion actually accessed, investigating insider concerns, and re-examining incidents that were closed without answers. If a breach was handled without forensics and notification decisions were made on assumptions, it is worth knowing while correction is still possible.

CORE CAPABILITIES

Core capabilities & deliverables

Digital forensics

Forensically sound acquisition and analysis across endpoints, servers, cloud platforms and identity systems, volatile evidence preserved, chain of custody maintained, findings that hold up to scrutiny.

Intrusion analysis

Reconstruction of the attack: initial access, tooling, lateral movement, persistence and objectives, mapped to MITRE ATT&CK, producing the timeline every downstream decision relies on.

Data impact assessment

The question that drives notification: what data was accessed, exfiltrated or exposed, established from evidence, logs, staging artefacts, transfer traces, to support your assessment under the Notifiable Data Breaches scheme.

Eradication verification

Confirmation the attacker is gone: persistence mechanisms found and removed, credentials rotated where compromised, and the environment monitored through the verification window, because a quiet network is not the same as a clean one.

Stakeholder-grade reporting

Findings delivered for each audience: technical detail for IT and security teams, clear facts to support notification decisions, and board-level summaries, one investigation, consistently told.

CORE CAPABILITIES

Core capabilities & deliverables

Digital forensics

Intrusion analysis

Delivery testing of current phishing and payload techniques against your email security, and probing of web filtering and perimeter controls, the entry points that begin most incidents, tested the way attackers actually use them.

Data impact assessment

Eradication verification

Stakeholder-grade reporting

Findings delivered for each audience: technical detail for IT and security teams, clear facts to support notification decisions, and board-level summaries, one investigation, consistently told.

METHODOLOGY AND FRAMEWORKS

Investigations follow a disciplined four-stage path, compressed as urgency demands:

Preserve

Volatile evidence secured first, memory, logs, cloud audit trails, with guidance to your team on what not to touch, the hours that decide what can ever be known.

Investigate

Acquisition and analysis across the affected estate, timeline construction and scope determination, with interim findings flowing to decision-makers as they firm, not held for a final report.

Determine impact

Data access and exfiltration established to notification-grade certainty, facts first, decisions properly founded.

Verify and hand over

Eradication confirmed, monitoring through the verification window, and findings handed to recovery and resilience uplift, so what was learned becomes what is fixed.

Investigations align to NIST SP 800-61 and ACSC guidance, support obligations under the Notifiable Data Breaches scheme, APRA CPS 234 and SOCI reporting, and are conducted by practitioners holding certifications including GIAC GCIH.

NIST SP 800-61

ASC Guidance

SOCI

APRA

CPS 234

FAQS

Frequently asked questions

Call us on 1300 085 366. Do not power off affected machines unless they are actively encrypting, shutdown destroys memory evidence; isolate them from the network instead. Preserve logs, note times and observations, limit knowledge of response actions to those who need it, and avoid rebuilding anything until evidence is captured. Then let the investigation establish facts before big decisions are made on assumptions.

Nothing needs to be ready before you pick up the phone, so call first. It helps if you can tell us when and how the problem was noticed, which systems appear affected, what has been done so far, and who in your organisation can authorise decisions such as isolating systems. Access to key logs and security consoles will speed things up once responders are engaged. If you are not sure whether it is an incident at all, call anyway, a false alarm costs far less than a late start.

Interim answers arrive in days, containment-relevant findings, initial scope, early indicators of data impact, while complete investigations typically run weeks depending on estate size and evidence quality. The discipline is flow: findings reach decision-makers as they firm, so notification and recovery decisions never wait for a bound report.

The degree of certainty depends on the evidence available, such as exfiltration traces, staging artefacts, access logs and attacker tooling. Sometimes the honest answer is a bounded probability, which we state plainly rather than dress up. Notification decisions under the NDB scheme turn on likelihood of serious harm, and our findings are framed to support that assessment.

Yes. Post-incident engagements answer the questions recovery skipped: how they got in, whether persistence survives, what was actually accessed, and whether notification obligations were assessed on facts. Attackers who retained access reappear on their schedule, not yours, verification now is cheaper than round two.

Yes, with the additional care they demand: your HR team engaged early, evidence handled carefully, and discretion throughout. Insider matters, data theft by departing staff, misuse of access, sabotage, are forensically similar to external intrusions, but the people side needs more care, and we plan for that from the start.

CONTACT

We're here to help.

Talk to a practitioner, not a call centre. Tell us what you're trying to solve and we'll come back to you within one business day. If you're dealing with an active incident, call us directly.

Head office

300 Ann Street, Brisbane QLD 4000

Let's talk

1300 085 366

Email us

info@cubecyber.com

Send us a message

Tell us what you're trying to solve and we'll get back to you within one business day.

We use the details you provide to respond to your enquiry. Your information is stored in our Microsoft 365 environment and handled in line with our Privacy Policy, which explains how to access or correct it and how to make a complaint.