T+00:00
Contact established
Reach out on any channel below. We confirm a single incident commander on our side.
Incident Response
Under attack right now?
Contact us on any channel below. Preserve evidence, avoid mass shutdowns, and keep a written log of every action taken from this moment forward.
Emergency intake open
Emergency contact channels
What the first hours look like
T+00:15
Triage call
Scope, systems affected, business impact and immediate containment options.
T+00:45
Evidence preservation
Guidance on memory, disk and log acquisition before remediation destroys artefacts.
T+02:00
Containment plan
Agreed actions, ownership and a communication cadence for the response.
Forensic capabilities
- Host disk imaging and timeline reconstruction
- Volatile memory acquisition and analysis
- Cloud control-plane and identity log review
- Email and business-email-compromise investigation
- Malware triage and indicator extraction
- Log correlation across SIEM and EDR sources
- Chain-of-custody documentation
- Written findings suitable for insurers and counsel
Retainer tiers
Standby
Pre-agreed terms, named contacts, annual tabletop exercise.
Priority
Committed response window, quarterly readiness review, playbook maintenance.
Embedded
Ongoing advisory plus response, with detection tuning between incidents.
Response commitments are agreed in your retainer contract. See methodology for how findings are scored and reported.
Discuss a retainer