Something got in. Let's get it out and get you back to work.
When an attacker gets into your email or your systems, you need someone to shut the door, keep the evidence, work out how they got in, and get you running again.
What we handle
- Business email compromise. A stolen mailbox login, fake invoices sent from your account, changed bank details, mail rules you didn't set.
- Account takeover. Strange sign-ins, new MFA devices, unknown app permissions in Microsoft 365 or Google Workspace.
- Ransomware. Stop the spread, keep what matters, plan recovery from your backups.
- Malware on a laptop or server. Remove it, find how it arrived, close that door.
If you have a cyber-insurance policy, call your insurer's claims line first. Some policies require a response firm from the carrier's own list. We won't put your coverage at risk. If your carrier lets you choose your own vendor, we are glad to work with them and with your attorney.
How an engagement runs
- Scoping callWhat you see, when it started, which accounts and machines. We tell you when we can start.
- Engagement letterA fixed scope and a fixed fee, signed before work begins. If your attorney is directing the response, the letter is set up through them.
- Containment and evidence preservationSessions cut, passwords and MFA reset, bad rules and apps removed. Logs and mailbox records are preserved before they age out, with each item hashed so it can be shown unchanged.
- Forensic analysisHow they got in, what they touched, and what data was reachable. Then we close that path and harden the rest.
- RecoverySystems back in service, cleaned and watched for a return visit.
- Report and walkthroughA plain-English report with a timeline your insurer and attorney can read, and a call to walk you through it.
What we don't do
- We don't negotiate with attackers or handle ransom payments.
- We don't write "who did it" reports, provide expert testimony, or build cases for court. If your matter needs that, we tell you on the first call and point you to the right kind of firm.
- We don't promise round-the-clock coverage. We tell you on the first call exactly when we can start, and evening and weekend starts are normal for us.
Common questions
Do you work remotely?
Yes. Most email and cloud incidents are handled entirely remotely with access you grant. We are based in the Tampa Bay Area and work with businesses across the US.
How much does it cost?
Most small-business email incidents fit a fixed fee that we quote on the scoping call, before any work starts. Larger incidents are scoped in phases so you always know the next number.
Should I tell my customers?
That is a legal decision for you and your attorney. Our report tells them what data was reachable so they can decide on notice.
Can we keep the incident quiet?
We keep everything about your incident confidential. We never name clients, and nothing about your case is shared without your written OK.
Not sure where to start?
Tell us what you are seeing or what your renewal asks for. We reply with a plain next step.