Why a documented RCA matters

When a security incident hits your website, the recovery itself is only half the work. In the days and weeks that follow, your legal team, your insurer, and often your enterprise clients will ask for a written record of what happened, how it happened, what was exposed, and what you did about it. Without that record, you are left explaining an incident verbally, months later, under pressure, and gaps in the narrative begin to look like gaps in the response.

The Security Incident RCA Report closes that gap. You get a structured document that traces the incident end to end, so your stakeholders can read a single authoritative source and walk away with a complete picture of scope, impact, and response.

What the report covers

Every RCA report includes four core sections:

• Attack timeline: a chronological reconstruction of the incident, from the earliest indicators we can identify through the point of containment.
• Vector identification: the entry method used by the attacker, which component was compromised, and the technical reason it was exploitable.
• Data exposure assessment: an evaluation of which data was accessible during the incident window, so you know what you need to disclose and to whom.
• Remediation steps: a plain record of the fixes applied, hardening changes made, and residual items still open.

Who this is for

This add-on is available to clients on our Grow or Manage website maintenance plans. The capability runs alongside your maintenance tenure on a monthly basis, so when an incident occurs the team is already engaged and the report is delivered without procurement delay. There is no per-incident cap - every security incident inside your active billing month is covered by the monthly fee. Charges are confirmed on quote, scoped to your current maintenance tenure - request a quote and we will confirm within one business day.