Incident Response
Contain the incident. Find the cause. Recover safely.
Senior responders join your team from the first call. We stop the spread, reconstruct what happened from the evidence, and help you return to normal operations.
- DetectUnusual API key usage from an unfamiliar network
- TriageScope confirmed: 1 cloud account, 3 service keys
- ContainKeys revoked, sessions killed, evidence preserved
- AnalyzeEntry point: CI token exposed in a public build log
- RecoverWorkloads redeployed from clean images
- ReportRoot cause, impact and hardening plan delivered
Illustrative example. Every incident runs on its own timeline.
Warning signs
When to call us
Suspicious activity
Unexpected logins, API calls or processes in production, cloud accounts or employee laptops.
Ransomware or extortion
Encrypted systems, a ransom note, or a threat to publish your data, suspected or confirmed.
Account takeover
An executive, developer or admin account acting in ways its owner cannot explain.
An outside warning
A customer, researcher or vendor reports your data or credentials circulating.
Not sure it is an incident? Call anyway. Ruling out a false alarm takes a short conversation. Missing a real one costs far more.
The process
How a response runs
Containment starts on the first call. The investigation runs alongside it.
Triage
We assess severity and scope with you and give containment guidance on the call.
Containment
Isolate affected systems, revoke compromised access, and preserve evidence before it is lost.
Investigation
Reconstruct the attack from logs and artifacts: the entry point, the timeline, and what was accessed or taken.
Eradication and recovery
Remove the attacker’s foothold, close the way in, and bring systems back from a known-good state.
Report and hardening
A written account of what happened and a prioritized plan to prevent a repeat.
Deliverables
What you receive
Written for your engineers and for the people who have to make decisions.
Incident timeline
The attacker’s actions step by step, built from evidence rather than assumptions.
Impact assessment
Which systems and data were affected, in terms your board, customers and insurer can act on.
Hardening plan
Prioritized fixes for the gap that was exploited and the others the investigation uncovered.
Before we join
In the first hour
Steps that protect evidence and limit damage while help is on the way.
- Disconnect affected machines from the network. Do not wipe, reimage or power them off.
- Preserve logs from your cloud provider, identity provider, VPN and endpoint tools.
- Rotate exposed credentials, and do it from a device you trust.
- Move incident discussion off email and chat accounts that may be compromised.
- Keep a written log of every action taken and when.
Report an incident
Tell us what happened. If it is active right now, say so in the first line.
Prefer to talk? Call +1 582 260 6089 or message us on WhatsApp.
