Owners and general managers
You need a plain account of what happened, what it means for the business, and what to fix first.
Digital Forensics & Incident Response
Digital forensics and incident response for businesses without a full-time security team
An alert you don’t recognise. A login from somewhere new. A customer asking about an email you never sent. When something doesn’t look right, you need clear answers: what happened, what was affected, and what to do next. ARA Industries helps you find out, keep the evidence intact and recover with a plan.
Dealing with an incident now?
Email securenow@ara.ph with “Incident” in the subject, or use the contact form and choose how urgent it is. Tell us your name, organisation, a number we can reach you on, and a one-line description of what you noticed.
Please don’t send passwords, evidence files or personal data by email or through the form. We’ll arrange a secure way to collect what’s needed.
While you wait, a few steps help keep options open
- Write down what you saw, when, and on which devices or accounts.
- Don’t wipe, reinstall or “clean up” affected devices yet. Our team will advise on how to isolate them safely.
- Keep a small group informed, and let your Data Protection Officer know.
Who it’s for
Teams and organizations of 20 to 500 people, anywhere in the world, that need to understand a security incident and act on facts.
IT leads and service providers
You need experienced hands, a documented method, and findings your team can act on.
DPOs, compliance and legal counsel
You need clear technical facts to assess a possible personal data breach and decide on notifications.
How an engagement runs
Six steps, from the first conversation to a stronger environment. Each step is documented so the work is consistent and repeatable.
Step 1: Consultation and incident assessment
We learn what happened, how it affects the business, which systems are involved, what evidence exists and what concerns you most. Together we agree the scope, priorities and response approach.
Step 2: Evidence preservation and acquisition
We identify the relevant digital evidence, then preserve and acquire it using forensically sound procedures: documented handling, integrity verification and chain-of-custody records where applicable.
Step 3: Forensic examination and analysis
We examine the relevant systems, endpoints, logs, network artefacts and files to find suspicious activity, build a timeline and identify indicators of compromise, following documented, standardised procedures.
Step 4: Investigation and root cause
We reconstruct the incident from the evidence: how the attacker likely got in, how far they reached, whether data may have been exposed, and any persistence or lateral movement.
Step 5: Findings, report and recommendations
You receive a structured report covering the findings, supporting evidence, incident timeline, assessed scope and impact, technical conclusions and recommended fixes.
Step 6: Remediation support and post-incident review
We help you and your stakeholders plan containment, eradication, recovery and prevention, and follow up with technical guidance to strengthen controls and lower the chance of a repeat.
Core DFIR capabilities
Cybersecurity incident investigation
Scoping and investigating suspected or confirmed security incidents.
Digital forensics and evidence preservation
Preserving and acquiring evidence with documented, verifiable handling.
Endpoint, system and log forensics
Examining devices, servers, cloud and application logs.
Malware investigation and reverse engineering
Analysing suspicious files to understand what they do.
Threat hunting and IOC analysis
Searching for indicators of compromise across your environment.
Root cause analysis and reconstruction
Rebuilding the timeline of what happened and why.
Data exfiltration investigation
Assessing whether data may have left your systems, and which data.
Technical reporting and recommendations
Clear reports with prioritised remediation steps.
Engagement approach
Every engagement is tailored to your environment, the severity of the incident, your business needs and what the investigation must answer.
We work only with proper written authorisation, under confidentiality and with evidence-handling controls. Our investigations follow forensically sound practices, documented procedures and repeatable analysis methods, so the findings are reliable, traceable and clearly explained to your management, regulators or legal counsel.
If personal data may be involved
The Data Privacy Act of 2012 (RA 10173, Sec. 20(f)) requires personal information controllers to promptly notify the National Privacy Commission and affected individuals of qualifying breaches. NPC Circular 16-03 (Secs. 17–18) sets a 72-hour window from knowledge or reasonable belief of a breach. We give your DPO and counsel the technical facts they need to decide; the decision and the notification stay with your organisation.
Before an incident
The best investigations start with good logs, tested backups and a one-page incident response plan. We can help you prepare.
Related insights
Threat Watch PH
How to Spot a GCash or Maya Phishing Text in 2026: A Field Guide for Filipinos
GCash and Maya say they never text links or ask for your OTP. How to spot a fake in 10 seconds, what to do in the first 10 minutes if you slipped,…
Threat Watch PH
PHP2Shell: Attackers Target Exposed Palo Alto Networks Firewall Management Pages
Palo Alto Networks reports active exploitation of the PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) against PAN-OS management interfaces exposed…
Threat Watch PH
Cybersecurity Awareness Month Wrap-Up: The Incidents That Hit Filipinos Hardest in 2026
Our Philippine Cyber Incident Map logged 32 incidents in 2026, nine of them confirmed. The five that hit ordinary Filipinos hardest, one lesson from…
Frequently asked questions
What is digital forensics and incident response (DFIR)?
DFIR is the work of investigating a security incident to establish what happened, how it happened and how far it reached, while preserving the digital evidence, and then using those findings to contain the incident, recover and prevent a repeat.
What should we do first if we suspect an incident?
Write down what you noticed and when, avoid wiping or reinstalling affected devices, keep a small group informed, tell your Data Protection Officer, and contact us at securenow@ara.ph. Our team will advise on the next steps for your situation, including how to isolate affected systems.
Do we have to notify the National Privacy Commission?
If personal data may be involved, the Data Privacy Act may require the personal information controller to notify the National Privacy Commission and the affected individuals. NPC Circular 16-03 sets a 72-hour window from knowledge or reasonable belief of a personal data breach. Your DPO or legal counsel makes that call; we provide the technical facts they need. This is not legal advice.
How is DFIR different from Managed Detection and Response?
Managed Detection and Response watches your environment continuously and responds to threats as they appear. DFIR is an in-depth investigation of a specific incident: what happened, how, and what it affected. Many organisations use both.
Do we need to use WithSecure to work with you?
No. We work with the systems, logs and security tools you already have. ARA Industries is also a registered WithSecure partner if you want to strengthen detection afterwards.
Do you work outside Metro Manila?
Yes. ARA Industries is Manila-based, working worldwide. Much of an investigation can be done remotely with your authorisation; onsite work is arranged per engagement.
How is a DFIR engagement priced?
Each engagement is scoped first, because the effort depends on the number of systems, the evidence available and what the investigation must answer. We confirm the scope and a written quote before work begins.
Free checklist · PDF
Check your readiness before an incident
39 plain-language checks across endpoints, backups, email and identity, patching, admin access, incidents and vendors.
For any Philippine SME or mid-sized business. Enter your details and the download opens on the next page.
Talk to us about incident readiness or a past incident
Book a free 30-minute Usap Tayo call with the ARA Industries team. For an incident in progress, email securenow@ara.ph instead.
Calendar not loading? Open the Usap Tayo booking page.
Prefer to write? Send us a message
Tell us what you need. Please don’t include passwords, evidence files or personal data.
- Fixed-scope cyber health check: recommendations before licences
- WithSecure Elements licensing, rollout and managed support
- AI, web and mobile app projects
Prefer a call? Book a 30-minute Usap Tayo session.