Cyber forensics and incident response.
Digital forensics and incident response (DFIR) for businesses after a breach, and for the counsel, insurers and clients who need an independent answer. One team for the whole arc of a security event: the call at 2 a.m., the forensic record that follows, the testing that proves it will not happen the same way again, and the letter that tells your clients and insurer it is closed.
$2M cyber liability insuranceSince 2018
Reviewed by the ITRS security team · Last updated
IT Rapid Support Inc. provides cyber incident response, digital forensics, penetration testing and security attestation from its office at 7810 Keele St in Concord, Vaughan, for organizations across Toronto, the GTA and Canada. It works for businesses after a breach and for the counsel and insurers acting for them, runs a 24/7 incident line at (289) 582-9930, acts as an expert witness on electronic evidence and carries $2M in cyber liability insurance. It has done this work since 2018.
Services in this practice.
Incident response, digital forensics, penetration testing and independent attestation.
Incident Response
When an attack is under way24/7 containment, scoping and recovery for account takeover, payment fraud and ransomware.
View the serviceDigital Forensics
Chain of custody, defensible analysisWrite-blocked acquisition, chain of custody and defensible analysis of devices and cloud.
View the servicePenetration Testing
Verified by hand, rated by impactExternal, internal, web application and Microsoft 365 testing, verified by hand.
View the serviceAttestation Letters
For clients, insurers and auditorsSigned, scoped letters for clients, insurers and auditors when the evidence supports them.
View the serviceSecurity Assessments & M365 Audits
Before a renewal or questionnaireAn honest, evidence-based baseline of your tenant and controls.
View the service
How an investigation runs.
- 01
Triage
A responder takes the call, establishes what is happening and what must not be touched, and agrees immediate priorities with you.
- 02
Containment
Access revoked, sessions terminated, affected systems isolated, with volatile evidence captured before it disappears.
- 03
Evidence acquisition & chain of custody
Logs, mailboxes and devices preserved with write protection, hash-verified and logged from collection onward.
- 04
Analysis
Artifacts correlated into a single UTC timeline: entry point, actions taken, data touched, and what was not affected.
- 05
Report & attestation
A written report for leadership, counsel and insurer, a remediation plan, and attestation when the evidence supports it.
What you are left with.
The attacker is out, the entry point is closed and the timeline is written down.
Every image and export carries a SHA-256 value recorded at collection.
Each finding was confirmed by hand and rated by real-world impact.
A scoped letter, issued only when the evidence supports it.
All services in this practice
- Incident Response
- Digital Forensics
- Penetration Testing
- Attestation & Assessments
- Business email compromise response
- Google Workspace compromise investigation
- For counsel, insurers and brokers
- Microsoft 365 and Exchange Online forensics
- Microsoft 365 security assessment
- Mobile device and messaging forensics
- Ransomware response
- Incident response tabletop exercises
One team across all four practices.
Privacy, Data Governance & AI
PIPEDA and Quebec Law 25 readiness, data mapping, breach notification and AI governance.
Legal Technology
eDiscovery and forensic collection for counsel, expert-ready reports and legal-tech advisory for firms.
Managed IT Support
Helpdesk and break/fix, networking, security systems, devices, Microsoft 365, cloud and backup.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.