Disconnect affected machines, don’t wipe anything, and call us
The first hour decides a lot. Pull affected devices off the network but leave them powered on, because evidence in memory matters. Stop using any account you think is compromised and change critical passwords from a clean device. Then reach us on the Under attack page. The instinct to “clean it up” yourself usually destroys the trail responders need and can let the attacker back in.
The job is simple to state and hard to do well: stop the bleeding, get you back to work, and make sure it can’t happen the same way twice.
What our incident response covers
- Containment first. Compromised systems are isolated and the attacker’s access cut before anything else.
- Recovery from clean backups. Systems are rebuilt from backups verified as clean, so you don’t restore the malware along with your files.
- Forensics. How did they get in, what did they reach, and what did they take. Answers, not guesses.
- Disclosure guidance. If you’re legally required to notify customers or regulators, we help you do it correctly and on time, working with your counsel.
- A fix, not just a cleanup. The gap that let them in is closed, and you get a plain-English report on what changed.
Handled according to your own security policy
If you already have an incident response plan, we work from it, not around it. Your severity levels, escalation contacts, approval steps and notification rules decide how each incident is handled. If you don’t have a plan yet, we help you write one and test it with a tabletop exercise before you need it.
- Documented steps. Every action is logged with a timestamp: what was found, who approved the next step, what was changed.
- Evidence handled with care. Logs, disk images and memory captures are collected and preserved so they hold up for insurers, counsel and any investigation.
- Post-incident fixes tracked to done. The findings turn into a remediation list with owners and dates, and we follow it until each gap is closed.
- A plan that gets better. After each incident, we review what worked and update your plan and runbooks with you.
Retainer or emergency, your call
You can reach us in an emergency with no prior relationship. A retainer is the smarter choice: your environment is documented in advance and response expectations are agreed up front, so nobody is onboarding in the middle of a crisis. Pair it with managed detection and response to catch the next attack earlier, and a penetration test to find the gaps before someone else does.
From breach to back to normal in four moves
Contain
Affected systems are isolated and the attacker cut off, stopping the spread before anything else.
Eradicate
The attacker’s access is removed and the environment checked for anything left behind.
Recover
Systems are rebuilt from clean, verified backups so you’re working again without reinfecting yourself.
Learn
Forensics, disclosure guidance and a fix for the gap, with a report you can actually read.
Incidents involving AI tools
Some incidents now start with AI tools: a client file pasted into an unapproved chatbot, an AI app granted access to a mailbox, or a deepfake voice approving a payment. The response steps are the same, plus a review of which AI services touched the data. AI governance helps prevent the next one.