As incident responders in the insurance space, we often respond to incidents where critical evidence is no longer available for analysis. This presentation will demonstrate how incident responders can use offensive security techniques to determine likely root causes and inform effective containment strategies.