Under attack? We respond now.
Ransomware, business email compromise, data breaches and compromised systems. Our responders contain the threat, investigate and get you operational again.
+971558551610First steps while you wait for us
- Disconnect affected machines from the network (unplug the cable or disable Wi-Fi), but leave them powered on.
- Use an out-of-band channel (phone, a separate email account) to coordinate. Assume corporate email may be monitored.
- Write down what you observed and when: ransom notes, unusual logins, alerts, screenshots.
- Identify who has administrator access and protect backups from further access.
- Call our hotline or submit the form below.
Common mistakes that destroy evidence
- Do not power off or reboot affected systems; volatile memory holds crucial evidence.
- Do not delete malicious files, emails or accounts before they are investigated.
- Do not contact or pay the attacker before speaking to responders and legal counsel.
- Do not restore from backups until you know they are clean.
- Do not announce the incident publicly before the scope is understood.
A proven incident response lifecycle.
Aligned with NIST SP 800-61, from preparation to lessons learned.
Preparation
IR plans, playbooks, retainers and tabletop exercises so your team knows exactly what to do.
Detection & analysis
Confirm the incident, determine scope and identify the attacker's entry point and activity.
Containment
Isolate affected systems and accounts to stop the spread while preserving evidence.
Eradication
Remove malware, persistence and attacker access; close the vulnerability that let them in.
Recovery
Restore systems safely from clean backups and monitor closely for re-infection.
Lessons learned
Root-cause report, regulatory timeline and a hardening plan so it does not happen again.
Incidents we respond to.
- Ransomware & extortion
- Business email compromise & payment fraud
- Data breaches & leaked data on the dark web
- Compromised servers, cloud accounts & web applications
- Malware & infostealer infections
- Insider threats & account takeover
Incident response retainer.
Pre-agreed terms, guaranteed response times and onboarding done in advance, so when an incident hits there is no procurement delay.
- Guaranteed response SLA
- Pre-deployed forensic tooling
- Annual tabletop exercise & IR plan review
- Unused hours convertible to proactive services
Tell us what you are seeing.
A responder will call you back. If you believe the incident is ongoing, call the hotline directly.
Report an incident
This form goes straight to our on-call responders. For the fastest response, also call the hotline.