Think you've been hacked? Start here.
We find out what actually happened, stop it, and tell you in plain language what to do next. Evidence first, no guessing.
Who it's for
- Strange logins, new admin users or password changes you didn't make
- Your server or cloud bill is suddenly busy
- Customer data showed up somewhere it shouldn't
- A Google, Microsoft or domain account was taken over
What's covered
Triage
First 24 hours: what is affected, with logs and evidence preserved before they disappear.
Contain
Revoke access, rotate keys, isolate affected systems, keep the business running.
Investigate
How they got in, what they touched and for how long.
Recover
Clean or rebuild, close the entry point, restore from known-good backups.
What you get
TimelineTriage starts within hours of your call.
PriceTriage from USD 1,000, then scoped.
- Incident report with a timeline and evidence
- A clear statement of what was and was not compromised
- Hardening checklist and a follow-up review
- Help preparing customer communication (we tell you when to involve a lawyer)
Not included
- Legal advice
- Ransom negotiation
Related services
01 Penetration TestingManual web app and API testing your enterprise buyers will accept. 02 App Security Review + FixFor apps built with Cursor, Lovable or Bolt. We review, fix in your repo and retest. 03 Cloud & Infrastructure SecuritySafe deploys, locked-down cloud, real backups and monitoring. 04 SOC 2 & ISO 27001 ReadinessImplement controls once, map them to both frameworks, pass the audit.