24/7/365 incident response
Under attack?
Call now. Our accredited CSIRT starts containment immediately.
While we reach you
What to do in the first minutes.
- Do not power off affected devicesShutting them down can erase evidence held in memory.
- Isolate them from the networkUnplug the cable or disconnect Wi-Fi on compromised devices.
- Use an alternate communication channelThe attacker may be reading your internal email.
- Do not pay or negotiate a ransomTalk to our team first.
- Write down what you observedWhat you saw, on which devices and at what time.
What happens next
How we support you.
Triage
We assess scope and severity.
Containment
We stop the attack from spreading.
Forensics
We preserve evidence and identify the attack vector.
Recovery
We restore operations and close the gap.
FIRSTCSIRT.esCREST