- Home
- Incident help
You're under attack.
Reach us now.
Email our incident team with URGENT in the subject. Senior incident responders work the case, not a call centre or a hold queue, and containment advice comes first.
Or use the contact form with the topic "Incident response or forensics".
Don't wait to be sure.
- Ransomware is active: encryption in progress or a ransom note found
- Unauthorized access to any system or data is confirmed
- Data exfiltration is in progress
- Business email compromise: fraudulent transfers are underway
- A destructive attack: wipers, sabotage or system destruction
- An insider, employee or contractor, is acting maliciously
- Signs of a nation-state or advanced persistent threat
Four steps, starting now.
A senior responder picks it up
An experienced incident responder, not a dispatcher, triages what you send and comes back to you.
Containment advice first
We tell you what to isolate, what to preserve and what not to touch, so evidence and options survive.
Remote response begins
Our team connects remotely to start investigation and containment, with forensic handling from the first minute.
Recovery and the record
We work the incident to closure, document it to a court-ready standard, and help you rebuild stronger.
Every minute counts.
Email the incident team now. If you are not under attack but want a team on contract before the next one, ask about a retainer with guaranteed response times.