When to call us
Suspicious sign-ins, mailbox rules you did not create, a supplier asking why you changed bank details, a ransom note, or a tip from our monitoring team. The sooner an incident is contained, the less it costs.
What happens next
- Triage call: we scope the incident with you and give immediate containment steps, such as revoking sessions, resetting credentials or isolating devices.
- Evidence preservation: logs are exported before they expire. Microsoft 365 audit and sign-in logs have limited retention, so this step is urgent.
- Investigation: we establish the initial access vector, what the attacker did and what they could reach.
- Eradication and recovery: we remove persistence such as OAuth apps, forwarding rules, new MFA methods or scheduled tasks, and help you restore safely.
- Report: a clear timeline, the impact, and what to change so it does not happen again.
Business email compromise
For Microsoft 365 we review sign-in logs, the unified audit log, OAuth grants, mailbox rules and message trace to establish exactly what was read, sent or changed. That gives you the facts needed for customers, insurers and regulators.
Compromise assessment
Not sure whether you have been breached? A compromise assessment hunts across endpoints, identity and cloud logs for signs of past or current attacker activity, and gives you a clear answer either way. It is often run after a merger, a leaked credential alert or a supplier breach.
Be ready before it happens
We also help write incident response plans and run tabletop exercises with your leadership, so the first incident is not the first time the plan is used.