Your First Call for
Incident Management.

Smoother response. Faster recovery. Reduced costs. 

Responding to today’s cyber attacks can be confusing and complex. Many organizations aren’t sure where to start or need help putting together an effective response strategy.
We can help. 

Learn More


MOXFIVE's Incident Management Platform approach introduces scale to the IR customer experience by focusing on speed and efficiency. Our Technical Advisors will work with your team to clearly define the incident and develop the most effective response strategy. Once a plan is in place, your Technical Advisor will work in tandem with an Incident Manager to build the team of experts needed and manage all incident response efforts through to completion.

Incident Management

Detection and
Restoration &
Help Desk
Dark Web
Detection &
Response (EDR)
Privileged Access

MOXFIVE’s platform approach enables victims of attacks to work with a Technical Advisor who provides the expertise and guidance they yearn for in this time of crisis, and at the same time facilitates the delivery of all technical needs required, consistently and efficiently.  

MOXFIVE Technical Advisors bring security expertise, predictability and integrity to the response process.


  • Turnkey incident management solution
  • Seamless integration into existing technologies
    and processes
  • Coordinate efforts among internal and external parties
  • Innovative loss mitigation strategies
  • Manage and track overall response progress against stated timelines
  • Technical resource for attack victims

The MOXFIVE Process

Our team has a proven playbook for leading incident response efforts – helping you respond with speed and precision.


  • Obtain incident details and provide initial technical guidance. 

  • Focus on incident containment, data preservation, and business recovery.


  • Establish action plan with counsel, victim, and service providers.

  • Provide engagement flow and timing. 


  • Engage and deploy appropriate service providers and solutions at the appropriate time.

  • Monitor engagement progress and costs.


  • Conduct a 30 / 60 day follow up to discuss  recommendations and longer term risks.

  • Provide ongoing technical guidance upon request.

Business interruption (BI) represents 36% of the cost of a cyber breach, averaging a whopping $1.42 million per breach.

From IBM’s "Cost of a Data Breach" Report, 2019
MOXFIVE Take:  Business interruption costs are most typically impacted by the lack of proper guidance on the response and overengineered solutions that inadvertently delay recovery efforts. We can change that.


Minimizing the Impact: Local Administrator Password Solution

Enabling Local Administrator Password Solution (LAPS) can help greatly reduce the blast radius of a cyber-attack and is a quick and simple process for most environments.

Minimizing the Impact: How Cloud-Based Services Could Reduce the Stress of Recovery

Using cloud-based services can help not only lift the burden of day-to-day IT and security tasks, but they can also provide a significant benefit when dealing with a ransomware attack.

Incident Management Chronicles: Striking The Right Balance

Finding the right balance between containment, recovery and forensics workstreams is the key to faster and more effective incident response.

Incident Management Chronicles: Recovery vs Forensics

The lines between forensics and recovery can easily blur during incident response. Using an approach that delivers both in parallel helps minimize business interruption and get organizations back online more quickly.

How to Mature Threat Hunting Programs

Building threat hunting skills within your team can help prevent burnout, up-level skills and give your team a broader understanding of your security environment.

Incident Management as a Platform: Scaling Incident Response

Learn how MOXFIVE's platform-based approach to incident management drives increased efficacy and quicker resolution of complex challenges while also reducing costs and ultimately making life easier for all parties involved.

Ransomware Payment Bans are Bad Policy

This year’s Colonial Pipeline breach turned a spotlight on the debate over whether or not cyber ransoms should be paid by victims of these attacks. This blog examines why we think payment bans are bad policy.

Open-source Security Spotlight: pfSense

Open-source software is used in a wide variety of projects, including the recent Mars helicopter, Ingenuity! In this blog, we take a look at the open-source network security solution, pfSense, and the many ways it can be used.

Visibility in Incident Response: Don’t Chase Ghosts in Your IT Estate

To effectively respond to a cybersecurity incident, having complete visibility into all assets (endpoint devices, applications, user accounts) across your IT estate is a critical success factor for recovering quickly and minimizing business disruption.

Dispatch from the Front Line

In July 2019 we posted our inaugural blog and introduced our idea of how a Technical Advisor could help companies better manage the incident response process. Two years (and hundreds of incidents) later, we've learned many lessons that help our clients recover quickly and effectively.

Tabletops Improve Incident Response

Tabletops can help improve organizational awareness and streamline Incident Response efforts. Learn how they can help mature your security posture and develop your teams' skills.

Maximizing Red/Blue Team Effectiveness

Fusing the efforts of your red and blue teams by implementing a purple team approach enables analysts to cross-train, collaborate, and respond more effectively during an incident.

Recover, Then Upgrade - One Problem at a Time

Four questions to ask if you're considering adding an upgrade to an in-progress recovery effort.

Common Misconceptions of Business Recovery

Recovering from a cyber incident is a complicated and challenging process. Read our top 6 factors that can help determine whether the recovery process runs smoothly... or not.

When it Comes to Cybersecurity, Money Talks

Changes in the cyber insurance industry are driving a change in how organizations are investing in security.

In Times of Crisis: Focus, Plan, Ask for Help

Every pilot learns the mantra "Aviate. Navigate. Communicate." during their initial flight training. Easy to remember in a crisis and it helps remind the pilot of the order of priorities required to execute an optimal recovery.

Ransomware is a Mere Symptom, Extortion-Based Crime is the Disease

Has the rise of ransomware distracted us away from the true issue at hand? Encrypted files, corrupted applications, deleted backups, and ...

Assessing Risk in the Wake of SolarWinds Attack

Over the last couple of weeks, we have all watched the details surrounding the SolarWinds attack unfold. The full scope of the attack wil...

Targeted Containment — Less is More

Prioritize efforts, consolidate focus, succeed.

Ransomware Recovery Tales: Prepare for Battle

Does your organization have everything it needs to be prepared for a ransomware incident?

Ransomware Recovery Tales: The Battle of Netwalker

Threat actors can deploy, ransomware without the need to build or manage underlying infrastructure.

Assessing Risk: The “How” is Just as Important as the “What”

See how we assess an organization’s security risk and ability to prevent ransomware attacks.

Backups: Ahh! To Zzz 😴

Sleep Soundly with Good Backups!

Ransomware Recovery Tales: Protect the Kingdom

For every ransomware incident MOXFIVE has assisted with, the primary concern during recovery has been the health of the core infrastructure

The Key to Successful Business Recovery

MOXFIVE’s “Break Glass” Strategy to Recovering from a Ransomware Attack Ransomware events can be the worst experience for any person

Think Before you “Brick”

Over the last year, insurance carriers have looked for innovative ways to expand coverage. One such area is coverage around “bricking”. A...

Incident Response: Endpoint Agent All the Things?

Understanding the role of Endpoint Technology in Incident Response

The Next Phase in Cyber Insurance

Cyber claims have departed from lost laptops and basic malware claims and the industry is now realizing that it's less prepared to deal with

Let’s Talk.

Whether you need immediate help responding to an incident or are just trying to better prepare for one, we can help. Complete the form below and it will go directly to our Technical Advisory team.