DFIR | 7AI

Activation

Whoever calls it, the clock is already running.

An incident outgrows containment when the adversary has more access than you can contain by shutting down one entry point at a time, or when there's confirmed impact to the business (stolen data, ransomware deployed, assets encrypted). That's DFIR territory. It works the same in reverse, you don't need your MDR to see it first. A credible lead (suspicion of a device that may have been compromised while traveling) is reason enough to activate on your own. Whoever calls it, what happens in the next 24 to 48 hours matters most.

Activation is always your call

Available to 7AI MDR and platform customers, PoC included.

A name, not a queue number

An Investigative Lead is assigned within 2 hours of activation, a senior practitioner who owns the engagement from start to finish.

Hours, not days, to traction

A scoping call is underway within 4 hours, starting from what's already known, not from a blank page.

No handoff, no cold start.

7AI is an AI SOC platform first, with MDR and DFIR built on top of it. Most AI SOC platforms only triage, investigate, and hand off a verdict. What separates a real response is whether the same team can move from there into containing it, eradicating it, and recovering from it, without pausing to bring in someone new. Their customers lose time chasing access and reconciling logs with a new vendor instead of acting on what they just learned. 7AI never makes that hand-off. Carry the same context straight from detection into response, and the faster that happens, the less room the incident has to grow.

Context, not just speed

In a conventional engagement, the first week often goes to evidence logistics, chasing down access, reconciling clock drift across systems, hand-joining identities across namespaces, work that produces no findings and still bills at incident response rates. The platform has been learning your environment since before the incident, so that week doesn't happen. Responders start with everything the platform already knows.

Already there when it mattered

An existing MDR relationship let forensic-grade investigation start immediately, with no new vendor and no cold start, the moment a suspected account compromise turned out to involve active data exfiltration.

Containment doesn't wait for a new tool, either

Pre-authorized actions, including session revocation, account suspension, and device isolation, execute simultaneously through the platform, not one at a time, so there's no gap for an adversary to exploit while waiting on the next step. Approval is already built into the workflow.

The same retainer, going further.

The platform absorbs the work that normally burns through most of a traditional hour bank, including collection, correlation, and timeline reconstruction, so the retainer goes further. Because the bill stays small and predictable, you don't have to be certain before you activate. You can act on suspicion instead of waiting for proof, which is exactly when acting matters most.

Evidence collection and correlation, at machine speed.

In one engagement, seven weeks of identity, audit, and collaboration-platform activity were reviewed, and tens of thousands of file operations were mapped across eight affected sites. That correlation work ran as a byproduct of the investigation, not a separate billable phase.

Scoping and timeline reconstruction

In the same engagement, every compromised account was identified with per-account compromise windows down to the minute, high-risk systems were separated from moderate-risk activity, and the breach window was definitively closed.

Engagement scoped to match severity, not a fixed template

Some situations resolve with a single scoping call and a handful of hours. Others need a full-scope investigation across systems, accounts, and log sources. Hours are spent in proportion to what's actually happening, not a one-size engagement.

Stronger after, not just recovered.

A typical DFIR vendor contains, eradicates, recovers, and leaves. 7AI keeps working during the engagement, including detection engineering, TTP-driven hunting, and MDR cover fire during red-to-green rebuilds, so you come out of it stronger against the next attempt, not just recovered from the last one.

Directed threat hunting, TTP-based, not IOC-based

In one engagement, persistence was ruled out method by method, covering mail-forwarding rules, Conditional Access changes, external sharing, and guest accounts, rather than assumed clean. That hunting surfaced a second, unrelated attacker already active in the environment, running credential-reset enumeration for weeks, which the customer's own tooling had never surfaced.

Detection engineering, back-tested against the real incident

New rules are built mid-engagement, validated against retained telemetry, and tuned against the environment's own baseline so they hold up under real traffic.

Findings that feed forward, not just a closed ticket

Every engagement closes with a written report, delivered within 10 business days, tracing root cause to evidence, plus prioritized remediation and detection recommendations fed directly back into your ongoing MDR coverage.

A report you can hand to the board.

Every engagement closes with a written report built for all three audiences an incident creates: the practitioners who fix things, the executives who answer for them, and the counsel who may need the record later. The report shown here is drawn from a recent, real 7AI engagement, with identifying details redacted and figures adjusted to protect the customer. Findings are documented with the same evidence-first transparency as every investigation on the 7AI platform.

Executive summary, timeline, and full scope of compromise.
Root cause and attack chain, traced to evidence.
Prioritized remediation and detection improvements, fed back into your program.

Readiness, not just response

A retainer that works even when nothing goes wrong.

Unused hours aren't wasted hours. Up to 20% of your retainer can go toward proactive readiness: incident response plan reviews, tabletop exercises, and response playbook development. Quarterly consumption summaries mean you always know exactly where the balance stands.

Activation

24/7

Direct incident response line, activated only with your approval.

Engagement models

Advisory, focused, or full-scope, matched to incident severity.

Engagement report

Business days from closure to a board-ready written report.

Proactive readiness

20%

Of unused hours applicable to IR planning, tabletops, and playbooks.

Question 01 / Speed

"How long from activation until your team has meaningful investigative traction in our environment?"

Listen for: an honest number that includes orientation and tool deployment, not just the time to a phone call.

Question 06 / Context

"What will your responders know about our environment before an incident ever happens?"

Listen for: specifics. Telemetry, baselines, and investigation history, not a promise to "get up to speed quickly."

Question 16 / Value

"What happens to the hours we do not use?"

Listen for: whether unused hours can fund readiness work, or simply disappear at renewal.

Questions

7AI DFIR, answered.

A pre-negotiated block of hours that gives you on-demand access to senior digital forensics and incident response practitioners, activated per incident through a 24/7 line. It delivers forensic expertise, root cause analysis, and post-incident reporting beyond the scope of standard detection and response.

PLAID ELITE is continuous security operations: 24/7 monitoring, investigation oversight, and response on top of the 7AI platform. The DFIR retainer is incident-grade forensics and response for the moments that go beyond day-to-day operations: full forensic collection and analysis, malware analysis, root cause determination, and formal engagement reporting. For PLAID ELITE customers, the handoff to the DFIR team is immediate and carries full context.

Containment, eradication, and recovery, plus forensically sound evidence collection and collaboration with your counsel and insurer.

The retainer is offered to 7AI customers: organizations running the platform, PLAID ELITE customers, and teams in an active evaluation. That's deliberate. The service is delivered through the 7AI platform, and the immediate transition from detection to full incident response exists precisely because the tooling and environment context are already in place before anything goes wrong.

Call the designated 24/7 incident response line at any time. Activation always requires your approval. A scoping call follows to establish the nature and scope of the incident, agree on priorities, and assign an Investigative Lead who becomes your single point of contact. Every engagement is scoped to severity, from a rapid consultation to a full-scope response, and re-scoped as the incident develops.

Traditional retainers start cold: the responders are new to your environment, and collection tools deploy mid-incident, so meaningful traction typically takes 24 to 48 hours. With 7AI DFIR, your responders work on the platform already running in your environment, so the engagement gets traction from the first hour instead of spending the first two days on orientation.

The offering is newer than the team. 7AI DFIR practitioners have worked cases together for years, with backgrounds spanning enterprise SOC operations and law enforcement, including engagements that supported legal proceedings.

Forensic work is performed with the discipline chain of custody requires, and the team coordinates with your legal counsel throughout the engagement. Engagement reports document findings, evidence, and actions in a form built to hold up to scrutiny.

The team can extend collection to data sources beyond the platform's existing integrations, such as cloud audit logs, using specialized forensic tooling deployed at your discretion during the engagement.

Up to 20% of unused retainer hours can be applied to proactive readiness work: incident response plan reviews, tabletop exercise facilitation, and response playbook development. You receive a quarterly summary of hours consumed and remaining.

DFIR without the cold start.