If it is happening now,
pick up the phone.
Tell us at the start of the call that it is a live incident and you will be routed accordingly. Our incident responders are on shift in all three security operations centres at every hour, so there is no out-of-hours version of this answer.
Not urgent? Use the contact page instead — it reaches the same people during working hours.
Four things
that help, in this order.
-
01
Do not turn anything off yet
Powering down a compromised machine destroys memory-resident evidence and can trigger whatever the attacker left behind. Isolate it from the network if you can; leave it running.
-
02
Write down the timeline
What you saw, when you first saw it, and what has been done since. Times matter more than detail — a rough sequence is worth more than a perfect description of one event.
-
03
Stop using the compromised channel
If email or a messaging platform may be involved, coordinate somewhere else. Discussing the response in a system the attacker can read is a common and expensive mistake.
-
04
Find who can authorise action
Containment usually means disconnecting something that somebody depends on. Knowing who can approve that, before it is needed, saves the longest delay in most incidents.
So you can have it ready.
None of it is a test. It is the shortest route to understanding what you are dealing with.
- What you are seeing
- The alert, the behaviour, the ransom note, the call from a customer — whatever made you pick up the phone.
- When it started
- First observation, and whether it is ongoing. If you are not sure, say so; a wrong guess is worse than an honest gap.
- What is affected
- Systems, sites, people. Roughly is fine. We will establish the real scope ourselves.
- What has already been done
- Including anything switched off, reset or restored. This matters enormously and is the thing people most often leave out.
- Who can authorise action
- The person who can approve disconnecting a system, disabling an account, or taking a service offline.
Use your escalation path.
If you are on a managed service, the escalation path agreed at onboarding and the named contacts on it are the fastest route into your own SOC queue — and it reaches people who already know your estate rather than starting from a blank page. The numbers on this page work too, at any hour.