Security / Suspected incident / Request assistance
For a suspected compromise, call to discuss containment, evidence preservation and investigation. We confirm availability and scope before accepting the work.
For active incidents, call rather than waiting for a form reply. We confirm scope, personnel and response arrangements during the initial conversation.
Request urgent incident assistance
U.S. number · Calls from other countries may incur international charges.
+1 (650) 397-1782 Call about an incidentNever share passwords, private keys or raw sensitive evidence over an unsecured contact channel.
Do not wipe machines or delete logs as a default first step. Coordinate any shutdown or isolation with the incident lead: containment matters, but volatile forensic evidence can disappear.
Incident response
The right approach depends on the incident, system ownership and business impact. We start with the facts and agree on the next defensible action.
Alert / symptom
Preserve evidence
Scope + contain
Repair + restore
Recovery retest
Contain harmful activity while preserving logs, timestamps and evidence custody needed to investigate it.
Illustrative triage sequence. Availability, actions and response times require agreement.
01 / CONTAIN
Prioritize safety and business-critical systems. Coordinate targeted isolation, account protection and containment without unnecessarily destroying evidence.
02 / INVESTIGATE
Collect available logs and timelines, identify affected accounts and systems, and distinguish confirmed compromise from assumptions.
03 / RECOVER
Sequence remediation and recovery, validate access controls and restored services, and document unresolved risks and follow-up actions.
Practical checklist
A response checklist, not a rigid timetable. Containment, evidence preservation, legal obligations and recovery may overlap or need a different order.
Before we begin
We establish the incident contact, business risk, affected systems and authority to act. Evidence collection, technical investigation, containment and restoration are then scoped based on the situation and available resources.
A request is not a guarantee of immediate availability. Any response coverage, staffing, timing and authorization must be agreed in writing.
Routine vulnerability assessments and retesting belong to our security validation services. For suspected malicious binaries, see malware analysis and threat research. For encryption or extortion incidents, review ransomware investigation. Do not upload raw malware samples or restricted evidence through the public contact form. Existing customers should follow their established support route for non-emergency escalations.
Frequently asked questions
Yes. Use the listed phone number or security email to request incident-response assistance. Availability, response time, specialist staffing and scope must be confirmed; we do not promise continuous staffing or a response SLA.
Suspected unauthorized account or API access, ransomware, credential compromise, cloud or mobile service intrusion, exposed data, suspicious production behavior or a significant active security event.
Please do not send passwords, private keys, customer data or raw incident artifacts through ordinary contact forms or unencrypted email. Call first and arrange an approved secure evidence-sharing channel.
No. Urgent incident-response availability is separate from a managed SOC, round-the-clock customer-environment monitoring or a guaranteed 24/7 remediation team. Ongoing monitoring and technical work must be separately scoped.
Use your existing support escalation route for routine cases. For a suspected active breach or urgent cybersecurity incident, call the incident-response number directly.
Security incident inquiry
Describe what you know. We can assess next steps without asking you to send secrets through a web form.
