- Home
- Incident Response & Forensics
- Mjolnir Shield rebuild
Containment is half the job,
the rebuild is the other half.
Mjolnir Shield is our post-incident rebuild. Once the attacker is out, we clean compromised systems, remediate every vulnerability found during the response, reset identity, harden defences and monitoring, and document the posture you end up with.
Restoring is not the same as fixing.
Too many organizations restore from backup and carry on without closing the route the attacker used. The result is predictable: the same actor, or a different one using the same weakness, comes back within weeks. Mjolnir Shield treats the period after containment as the chance to rebuild from a clean foundation.
The rebuild is led by the responders who worked your incident. They have seen how the attacker moved, where they persisted and which accounts they used, and that knowledge shapes every decision. Mjolnir Shield is best scoped as part of the response, not after it, so there is no gap between eviction and rebuild.
A note on names: Mjolnir Shield is this rebuild service. Shield is also the first tier of our IR retainer; the two are different things.
- A rebuild plan sequenced from the incident findings and your business priorities
- Identity reset: privileged and service accounts, MFA and access policy
- Every vulnerability found during the response remediated and verified
- Systems rebuilt from verified clean media and hardened to recognised benchmarks
- Monitoring tuned to the techniques used in your incident
- A documented record of the restored security posture for your board, insurer and auditors
Five phases, from scope to watch.
Assess and plan
We map every system, account and network path that was compromised or possibly accessed, verify which backups are clean, and sequence the rebuild around business-critical systems.
Reset identity
Compromised credentials are the most common way back in. We recover or rebuild the directory, rotate privileged and service credentials, and enforce MFA and conditional access.
Rebuild the network
Segmentation redesigned, firewall rules audited and hardened, remote access and DNS secured, with monitored chokepoints for lateral movement.
Harden systems
Servers and workstations rebuilt from clean media, hardened to recognised benchmarks, with endpoint detection deployed and unnecessary services removed.
Monitor
Logging and detection tuned to the attacker's known techniques, so any attempt to return is caught early.
Who it is for
Any organization coming out of an incident, whether we handled the response or someone else did. It matters most where the attacker had privileged access, or where the business needs to show its board, insurer or regulator that the weakness is actually gone.
- Incident response, the containment that comes first
- MSOC, someone watching afterward, around the clock
- Vulnerability assessment, confirm nothing else is left open
- Compromise assessment, confirm the attacker is fully gone
What buyers ask.
Our IT team will handle the clean-up.
They will handle the rebuild, and we work alongside them. Our job is to make sure the vulnerabilities that let it happen are actually gone, and that the attacker's persistence went with them.
Can't we just restore from backup?
Only once you know the backup is clean and the way in is closed. Restoring a tainted image, or restoring a clean one onto the same weakness, invites the same attacker back.
Is this the same as the Shield retainer tier?
No. Shield is the first tier of our IR retainer, which puts responders on contract before an incident. Mjolnir Shield is the rebuild after one.
Do not just restore. Rebuild.
Scope Mjolnir Shield with the responders who know your incident. No charge, no commitment.