Emergency Incident Response

If you are responding to an active security incident, contact us now using the form on this page and include a callback number. We respond to emergency requests as a priority and establish confidentiality and engagement terms immediately so work can begin.

Immediate steps

1. Preserve evidence. Do not wipe, rebuild, or restore affected systems until they have been imaged.

2. Isolate affected systems from the network where you can do so safely, but keep them powered on.

3. Notify your legal counsel and cyber insurance carrier. Many policies require prompt notice and use of approved responders.

4. Avoid communicating with the threat actor until you have a response plan and a negotiator.

5. Use out-of-band communication, such as personal phones, if you suspect email or collaboration tools are compromised.

What happens when you contact us

1. Intake and conflict check. We confirm the nature of the incident, the parties involved, and any conflicts.

2. Confidentiality and engagement terms. A non-disclosure agreement and engagement terms are executed digitally, through your counsel where privilege is intended.

3. Retainer. An emergency retainer is established, reflecting the depth of work incident response can require.

4. Incident command. We take command of the response, coordinating with counsel, insurers, forensics, and your technical teams.

Services available during an incident

• Incident Response Retainer

• Incident Command and Executive Advisory

• Digital Forensics and Investigation

• Ransomware and Extortion Response

• Breach Notification Analysis

• Post-Incident Assessment and Root Cause Analysis

• Post-Incident Remediation Program Management

• Threat Intelligence and Exposure Monitoring

Existing retainer clients

Clients with an incident response retainer should use the escalation contacts provided in their retainer agreement for the fastest response.