You shouldn't have to explain an incident to someone three time zones away.
A technician on call around the clock picks up the phone, not an answering service. We image first, clean second, and document it the way your insurer's adjuster expects.
$165 an hour, any hour. No after hours rate, no weekend rate, no emergency surcharge.
Same day onsite for contract clients anywhere in Montana. Everyone else is scheduled same day where availability allows.
GIAC certified forensic analysts, so the evidence holds up for your carrier and your counsel.
“James and his team at Big Sky Cybersecurity are an integral part of my business' team as they help to protect my business from various cyber threats.”
★★★★★
Usually you don't get to pick your Incident Response Team.
Three people have a stake in how an incident is handled, and each needs something different back.
Most of our incident work comes at the insurer's request. When a carrier is paying the claim, they decide who touches the evidence.
They want
Evidence preserved before remediation, documented for the adjuster.
Counsel needs to know what happened before deciding who must be notified, and often wants the work done under their direction.
They want
Whether sensitive data left or was viewed and a timeline they can rely on.
Most of our work happens alongside your existing provider, not instead of them. They know your network; we know breaches.
They want
A partner who briefs them and leaves them in place.
If your provider's setup contributed, we'll tell you plainly and put it in the report. That isn't a sales pitch; it's what the carrier will ask anyway.
What we commit to in writing.
Commitments, separate from travel. The clock and the hour count are the same whenever you call.
When the clock starts
At a confirmed event or your notice to us, whichever comes first.
Ransomware
Response within 1 hour for certified clients.
Business email compromise
Response within 1 hour for certified clients.
Backup recovery failure
Response within 4 hours for certified clients.
Nights and weekends
The same commitments hold at 2 a.m. Sunday.
If it needs hands
Same day onsite for contract clients, anywhere in Montana.
What incident response looks like for most breaches.
Six stages. This is the sequence the rest of the site refers back to.
01
You call us
A technician on call picks up, not an answering service. First question: is this live, and what has been done so far?
02
Evidence preserved
Forensic images before wiping any device, with chain of custody from the first image. This is the step that decides whether your claim holds.
03
We're onsite
Physical access lets us contain in hours instead of days, working alongside whoever already supports you.
04
The report
A one page summary for a board, then the full timeline of the intrusion, gone through with your team line by line.
05
Answers
How they got in, what they touched, what left the building, and whether they still have access.
06
What changes
The entry point closes, credentials are reset properly, and logging is set to catch the next attempt.
Who pays for incident response? What's the cost?
Every route, published. Nobody finds out what an incident costs after it is over.
Certified clients
The Big Sky Guarantee
No added cost
We do the response work ourselves, within defined service limits.
Retainer clients
Hours banked in advance
80 hours
Priority response, drawn down as the incident needs it.
Everyone else
Standard rate
$165 an hour
No after hours rate, no weekend rate, no emergency surcharge.
The Big Sky Guarantee is not an insurance policy. It's our commitment to do the response work ourselves. Eligibility requirements, service limits and exclusions apply.
Incident response, priced before we start.
We give you an estimate before we begin, and tell you the moment it changes. The same at 2 p.m. Tuesday or 2 a.m. Sunday.
Ransomware
40 to 80 hours
For most small and midsize businesses, a week to two weeks of analysis once containment is done.
Most common
Business email compromise
About 16 hours
Mailbox review: what they saw, what they sent, and who they contacted.
Retainer
80 hours
Priority response and incident hours banked ahead of need, scoped to your environment.
Forensic standards, without the out of state handoff.
Many IT firms subcontract incident response. Other providers bring us in. You get forensic work done to that standard, from a team that lives and works in Montana.
Findings that hold up under review
Built to recognized forensic standards, so the report stands up when an adjuster or opposing counsel reads it closely.
Close enough to be in the room
Our offices are in Great Falls, Billings and Helena. When an incident needs hands on equipment, it's a drive, not a flight.
Your time zone, start to finish
The analyst who images your machines is the one who briefs your attorney and your board, on Mountain time.
What Montana law requires.
Two separate obligations, and they are often confused. Your attorney makes the call; we provide the facts to make it with.
Below is recent work our team has completed.
Caught at 2 a.m., before anything was encrypted.
The school's XDR alerted overnight. We were in the environment before staff arrived. The attackers already had footholds and were testing accounts, and we locked them out before the school day started.
Outcome
No data encrypted or accessed, and every affected system remediated and hardened within two weeks.
Called resolved. The attacker still had access.
Another provider had declared an email compromise closed. We came in 80 days after the initial compromise and found sessions had never been revoked, so the attacker had kept access for over a week.
Outcome
Access fully removed, MFA and a year of logging enforced, and a documented timeline for law enforcement.
The Madison River near Ennis, Montana
Frequently asked questions
What does the first phone call cost?
Incident work is billed at $165 an hour from the time work begins, and we tell you when the clock starts. There's no separate emergency rate, after hours rate, or weekend rate. If you'd rather have hours banked in advance, that's what the retainer is for.
How fast can you actually be here at 11 p.m. on a Saturday?
A technician is on call and answers the phone, not an answering service taking a message. Contract clients get same day onsite anywhere in Montana; everyone else is scheduled same day where availability allows. If you call late in the day from the far side of the state, that may mean first thing the next morning, and we'll tell you which on the call.
Do we legally have to report this?
It depends on what the forensics find. Montana requires notification when unencrypted personal information about a resident was acquired without authorization — and if the data was encrypted and the key wasn't taken, notification generally isn't required. That determination is a forensic question first and a legal one second. Your attorney makes the call; we give them the facts to make it with.
We're a 12 person business. Are we too small for this?
No. Most of our incident work is with Montana organizations under 20 employees — schools, clinics, nonprofits, and small businesses. Montana's privacy law now reaches smaller businesses than any comparable state statute, so being small doesn't reduce your obligations.
What if we already wiped and reimaged the machine?
Call anyway. Some evidence survives reimaging and some doesn't, and what remains often still answers the question that matters — whether data left the building. What we can't do is recreate what was overwritten, which is why the first instruction on any call is to stop touching the affected systems.
What can't you do?
Same day doesn't mean same day resolution. Onsite the same day means we're at your door the same day. It does not mean your systems are back the same day. Containment is usually hours; understanding what happened is usually days. And we can't recover what was never backed up, or fix backups that were encrypted along with everything else. Forensics tells you what happened; it doesn't put the data back.
Will calling you make things worse legally?
Sometimes forensics finds that data left the building, and that finding creates a notification obligation you'd otherwise not have known about. That's the honest trade. The alternative isn't avoiding the obligation — it's failing to meet one you already had, which is what regulators and insurers actually penalize.
Can you work with our current IT company, or do we have to replace them?
Work with them. Most of our incident engagements run alongside a client's existing provider. They know your network; we know breaches. We brief them as we go, document what we did, and when it's over you keep whoever you had.
Our insurance company wants to assign their own firm. Can we use you instead?
Usually yes, and in most of our incidents the insurer is the one who asked for us. Insurers care that evidence is preserved correctly and documented in a format their adjuster can use, not about which firm does it. Call your insurer before you authorize any remediation work, and call us at the same time.