When an organisation discovers a breach, the response moves fast. Incident responders are called in, endpoints are isolated, passwords are reset, logs are reviewed, lawyers are briefed, and regulators and customers may need to be told. All of this is essential.
One question is still often left open: what happens to the data that has already left the building?
Incident response solves the system problem
Specialist incident-response teams help organisations contain the attack, remove the threat actor, find the entry point, preserve forensic evidence, restore systems and support legal and regulatory reporting. They answer the first emergency questions: how did the attacker get in, are they still inside, which systems were affected and what must be rebuilt?
Those questions are about the environment. They are not the only questions.
The missing layer: control of the data itself
In many modern breaches, the worst damage happens after files have been copied or databases exported. At that point the problem is no longer only about stopping access. It is about reducing the usefulness and risk of data that may already be outside authorised control.
That is the stage PastWipe™ is built for. Incident response deals with the compromised environment; PastWipe focuses on the compromised data. It works alongside incident responders, not in place of them.
Why both layers are needed
With incident response alone, the attacker can be removed while copied data is still sold, leaked or used for fraud and extortion. With data controls alone, the attacker might still be active inside systems. A sound post-breach model has two layers:
- System containment, led by incident responders: isolate systems, remove malware, disable compromised accounts, find the root cause, rebuild and preserve evidence.
- Data control, at the data layer: re-check conditions when protected data is used, deny, restrict or degrade use outside approved conditions, and record each decision as evidence for legal, risk and compliance teams.
What regulators, insurers and boards ask
After an incident, organisations are judged on how prepared they were and what they did next. Typical questions are: what was taken, was the attacker stopped, was the data usable, what evidence exists, and what was done to reduce harm? Forensic reports explain how the incident happened. Data-level evidence helps show that a control strategy was in place for the moment prevention failed.
Encryption alone is not enough
Encryption protects data at rest and in transit under expected conditions. If an attacker uses valid credentials, reaches decrypted files through legitimate workflows or exports data with privileged access, encryption has already done its job and the data is exposed. The realistic assumption is that sensitive data may leave authorised environments, and the question becomes whether its usable value can still be reduced.
Where enforcement applies
PastWipe works alongside breach prevention and response. It reduces the usable value of stolen or exfiltrated data outside approved conditions, within supported workflows, and records what happened. Copies that have already become unrestricted plaintext, and photographs of a screen, are outside enforcement.
Two questions for every incident plan
- How do we stop the attacker?
- How do we reduce the damage if the data has already gone?
Incident response answers the first. PastWipe helps with the second.
How PastWipe works · Integrations and deployment · Scope an evaluation
All insights and news · Get the quarterly Post-Breach Briefing