Contain
Isolate affected accounts and devices. Pause risky remote access. Protect backup copies from the same encryption.
Home · Services
Incident response
A path for the bad day.
Containment, communication, and recovery when mail is hijacked, files are encrypted, or a laptop with client data goes missing.
Before and during
The plan is written on a calm day. It is used on a loud one.
Incident response has two halves. First, a short playbook: who is called, which accounts get disabled, how backups are protected from being overwritten, and what staff should stop doing. Second, help while an incident is open — stabilizing systems and preserving enough detail to explain what happened.
We coordinate with your leadership. If counsel or an insurer needs to lead notifications, we support the technical facts rather than improvising the legal ones.
Understand
Identify the entry, the data that may have been exposed, and the systems still trustworthy.
Restore
Bring back the functions the business needs first, from known-good copies where possible.
Close
Reset the conditions that allowed it, and update the playbook so the next hour is shorter.
If something is happening now, say so in the first line.
Use the briefing form and mark the subject as an active incident. We treat that note ahead of general inquiries.