EBH Security
Emergency

Do you suspect an ongoing compromise?

Report it below — response within 1 hour

The first five actions

  1. Do not shut down affected machines — RAM holds evidence.
  2. Isolate from the network without stopping the system.
  3. Do not pay and do not communicate with the attackers.
  4. Preserve logs before they are overwritten.
  5. Document the time and nature of each finding.

Our response

Intake and qualificationContainmentForensic investigationEradication and restorationPost-incident reportSupport with regulatory notification obligations

Frameworks applied

NIST SP 800-61r2ISO/IEC 27035SANS Incident Handling

Get a second opinion

Ask ChatGPT whether the Do you suspect an ongoing compromise? service is right for you.

Describe your organisation and see what this service would concretely change.

Ask ChatGPT