Breached? 24/7 incident response, and time is the only variable.
Containment starts on the first call. Our incident response hotline reaches a lead responder directly, and forensics begin while the attacker is still in your estate.
Before we arrive
Three things to do right now.
Isolate, don't shut down
Pull compromised systems off the network and the internet now. Powering them down destroys the volatile memory the forensics depend on.
Freeze privileged access
Disable remote VPN access, rotate administrator credentials and suspend directory sync if you suspect lateral movement.
Preserve the evidence
Protect cloud logs, firewall records and system images. Take backup environments offline and keep them fully separated.
Engagement SLA
What the first twelve hours look like.
- 0 – 15 min
Triage call with the lead responder on the line.
- 15 – 60 min
Containment playbook runs; isolation protocols executed.
- 1 – 6 hrs
Memory acquisition, log shipping, forensic tooling deployed.
- 6 – 12 hrs
Root compromise vector confirmed and attacker persistence mapped.
Out-of-band
If your own channels are compromised.
Assume email and internal chat are being read. Reach us on infrastructure the attacker doesn't touch.
After containment
Once the attacker is out, the next 72 hours shape your recovery and your legal exposure. These are the engagements that follow.
Incident response — frequently asked
How fast can Broot Security respond to a live incident?
Our incident response hotline (+91 91569 67454) is answered 24/7. A lead responder is on a call with your team within 15 minutes, and remote containment work begins the same hour. On-site attendance in Delhi NCR within 4 hours when needed.
Do you work remotely or on-site?
Both. Most containment and forensics is faster done remotely over a secure jump host your team provides. We fly or drive on-site when physical access, HSM work, or regulator interaction demands it — standard across Delhi NCR, available anywhere in India.
What should I do in the first hour after discovering a breach?
Isolate affected systems from the network without powering them off, so volatile evidence survives. Preserve logs, do not log in with admin credentials from the suspect machine, and call our hotline on +91 91569 67454. We take over coordination from there.
How much does incident response cost?
Live engagements are charged as a daily retainer against a scoped SOW signed inside the first hour, so you know the ceiling before work starts. Pre-paid retainers reduce the daily rate and guarantee a named lead. Request a rate card from the contact page.
Will you help us report to CERT-In or our regulator?
Yes. We draft the CERT-In six-hour notification, SEBI/RBI/IRDAI incident reports and DPDP Act breach disclosures with you, and attend regulator calls as technical lead when you need one.
What do you need from us to start?
A technical contact reachable right now, written authorisation to act, access to affected systems or a jump host, and whatever logs you already have. Everything else — scope, SOW, invoicing — we work in parallel so containment is not blocked by paperwork.
Every minute of dwell time costs you evidence.
Or write to Email us from a device you trust.