Breached? Time is the only variable.
Containment starts on the first call. A lead responder picks up, and forensics begin while the attacker is still in your estate.
Before we arrive
Three things to do right now.
Isolate, don't shut down
Pull compromised systems off the network and the internet now. Powering them down destroys the volatile memory the forensics depend on.
Freeze privileged access
Disable remote VPN access, rotate administrator credentials and suspend directory sync if you suspect lateral movement.
Preserve the evidence
Protect cloud logs, firewall records and system images. Take backup environments offline and keep them fully separated.
Engagement SLA
What the first twelve hours look like.
- 0 – 15 min
Triage call with the lead responder on the line.
- 15 – 60 min
Containment playbook runs; isolation protocols executed.
- 1 – 6 hrs
Memory acquisition, log shipping, forensic tooling deployed.
- 6 – 12 hrs
Root compromise vector confirmed and attacker persistence mapped.
Out-of-band
If your own channels are compromised.
Assume email and internal chat are being read. Reach us on infrastructure the attacker doesn't touch.
Every minute of dwell time costs you evidence.
Or write to contact@brootsec.com from a device you trust.