Report a security incident
Fill in what you know now. Don't wait for the full picture, with the first three fields we can already start.
Disconnect the machine from the network. Powering off destroys volatile memory, where the best evidence usually lives.
Not files, not accounts, not logs. Every premature cleanup reduces what we can reconstruct later.
Photograph what's on screen and note the exact time of each observation. It becomes the timeline.
Don't answer the attacker or accept deadlines until we talk. The first reply conditions the whole negotiation.
The form is the recommended path: it arrives with the fields the analyst needs to start. If you can't use it, write and we respond anyway.
The report is handled as TLP:RED until you authorize otherwise. We don't share your identity with third parties or in intelligence reports.
We handle emergencies without a prior contract. The retainer only makes us start sooner.