Contact & Incident Intake
Whether you are under an active attack requiring rapid containment or planning ahead to establish a priority retainer, choose your operational track below:
Under attack now? → Follow the Emergency Triage Steps below or access the full First Responder Protocol.
Planning ahead or general inquiry? → Jump directly to the Engagement Form or view Direct Contact Details.
Active Breach Stabilization
Hasty remediation destroys volatile evidence and alerts human adversaries. If an intrusion is suspected or underway, stabilize your environment using the following triage rules while initiating CIRT engagement.
Not Technical? Start Here
If you suspect something is wrong with your computer, take a breath. You don't need to be a cybersecurity specialist to prevent further problems.
1. Disconnect from the network: Unplug the network cable (Ethernet) from the computer, or disconnect from Wi-Fi. Leave the computer powered on and running.
2. Contact your internal IT team first: If your company has internal IT staff or an MSP, alert them immediately so they can begin investigation. If you do not have internal IT, contact us directly.
3. Use a separate device: Make all phone calls or send emails from your personal cell phone rather than your work computer or work email account.
5-Point Incident Stabilization Checklist
- 1. Network Isolation: Unplug physical Ethernet cables, disable Wi-Fi, or apply host network isolation. Keep the computer powered on and do not reboot or gracefully shut down (this preserves volatile RAM, injected code, and active attacker artifacts).
- 2. Active Encryption Exception: If files are actively locking or ransom notes are appearing, immediately pull physical power cords or force a hard shutdown to save unencrypted blocks. Sever backup storage and NAS network connections immediately.
- 3. Avoid Premature Remediation: Do not run antivirus or disk cleanup scans (scanners destroy $MFT records and timestamps). Never log into suspect systems using Domain Administrator credentials.
- 4. Move Out-of-Band: Coordinate incident communication exclusively via personal phones or personal accounts—never use enterprise email, Microsoft Teams, or internal VoIP.
- 5. Log Activities in UTC: Maintain an immutable activity log recording all systems touched, changes executed, and timestamps in UTC before initiating external CIRT engagement.
For comprehensive forensic rationale, chain of custody workflows, and a monochrome letter-sized printout formatted for your physical server room binder, access the full protocol dossier.
First Responder ProtocolTo-dos while awaiting CIRTDirect Contact Details
Contact us with the freedom of a full email window. Include any and all information you want.
Response Availability: Retainer clients receive priority response per agreement terms. General inquiries and active incident intakes are reviewed and triaged on a best-effort basis.
C0F1 627C 089C 7BC0 0B58 3ADE D46E 1735 0909 3370-----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEatPj4xYJKwYBBAHaRw8BAQdAbZ7uFHLt1mBA80RwGG5c0uE+/0P4b9BS3yXc
lIKyw4G0NUNoYXNlIEJlcnJ5IChwZ3Atd2Vic2l0ZS1rZXkpIDxjaGFzZUB2ZXNw
ZXJkcnlmdC5jb20+iJYEExYKAD4WIQTA8WJ8CJx7wAtYOt7Ubhc1CQkzcAUCatPj
4wIbAwUJAeEzgAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDUbhc1CQkzcAQI
AQCikSiQTbxotPqok1NZRVgPbC/9fPLrlxC0swmgFrTdRwEA031h5fB8GfBjtW73
0KHn/Etl82EwcvlA6JnZGuhKCAq4OARq0+PjEgorBgEEAZdVAQUBAQdA2c0FieKd
ME8HaJDTHWC/Cjt5IazbRIXlyB5b5hhnEUcDAQgHiH4EGBYKACYWIQTA8WJ8CJx7
wAtYOt7Ubhc1CQkzcAUCatPj4wIbDAUJAeEzgAAKCRDUbhc1CQkzcOdnAQDKtrhu
x3Ya+YozHjN8FjFuL0BZh9RZyQ5SitdYTaMj4QD+KPL5t4OQuJxQ0jO6nZz8UhEt
ebv44m5YIXNV0lwJ3A0=
=RuYK
-----END PGP PUBLIC KEY BLOCK-----What to Expect: From Intake to Resolution
When Dealing With an Active Breach
- 1. Immediate Stabilization: If you have internal IT staff, have them follow the First Responder Protocol above to isolate suspect systems. If you don't have IT staff, skip straight to contacting us.
- 2. Direct Diagnostic Triage: Reach out by phone or email (calling is faster). Tell us what you observe; we ask targeted diagnostic questions and guide you through immediate containment steps.
- 3. Transparent Scoping: We review your incident scope, agree on transparent rates before beginning hands-on triage, and present clear options for standalone emergency response or converting into a priority retainer.
- 4. Telemetry Deployment: Your IT team deploys Velociraptor and/or Wazuh across suspect endpoints (we can walk your team through deployment step-by-step, or provide single-click standalone collectors for isolated machines).
- 5. Eradication & Root Cause Analysis: We clean compromised assets, reconstruct adversary timelines, deliver a comprehensive Root Cause Analysis (RCA) report, and provide practical recommendations to prevent future attacks.
When Establishing a Priority Retainer
- 1. Environment Assessment: We schedule a consultation to review your network architecture, critical asset inventory, and compliance obligations.
- 2. Telemetry Pre-Staging: Every retainer client gets Velociraptor and Wazuh agents pre-deployed across their endpoints (even without a recurring monitoring subscription), ensuring immediate access and historical telemetry if an incident occurs.
- 3. Frictionless Activation: When an incident occurs, you call your priority line. With contracts and terms pre-approved, we mobilize immediately without onboarding delays.
Contact Form
The easy way to get our attention: just fill out the form and let the website handle the rest.
Security Notice: This web form is intended for non-sensitive inquiries and initial scoping only. Never submit passwords, private encryption keys, credentials, or sensitive forensic evidence through this form. For sensitive evidence transmission, contact us directly for our secure PGP-encrypted channels.