ACTIVE INCIDENT? START HERE.

CONTAINMENT FIRST.POST-MORTEM LATER.

  • Blast radius before root cause

    The first hour goes on stopping the spread: access cut, keys rotated, the reachable surface mapped. Understanding how they got in is the second hour's job.

  • Evidence, not assertions

    Every line of the incident write-up carries the thing it rests on: the log entry, the request, the exploit re-run against a copy. A report is not security.

  • We know the AI attack surface

    Prompt injection, agent credential theft, tool abuse, runaway spend. The failure modes we build runtimes to survive are the ones most responders have never seen.

  • You keep the machine

    You finish with the detections deployed, the runbook written and the fixes merged into your repo. Not a PDF and an invoice.

Or reach us directly

If the form is not working for you, or you would rather not fill one in mid-incident, this inbox is monitored.

Open an incident

The more of this you can fill in, the faster the first reply is useful. If you are mid-incident and short of time, the last field is the one that matters.

By submitting this form you agree to our privacy policy.

How we handle an active incident

  1. 01

    Triage and containment

    An engineer picks up, gets access scoped to what is needed, and works with you to stop the spread. Credentials rotated, the path in closed, the service back up on something we can watch.

  2. 02

    Eradication and recovery

    We establish how they got in and close it properly rather than papering over the symptom. Recovery runs on a path we can show is clean, not one we assume is.

  3. 03

    Proof and hardening

    Timeline, evidence and root cause written down in something you can hand to a customer or a regulator. Detections deployed, fixes merged, and the same door does not open twice.

Nothing is on fire?

Then this is the wrong form. The work we do before the incident is the cheaper half.

SEE THE SERVICES →