Incident response

Under attack? Call now.

Answered 24/7. Clients and non-clients. A responder answers — not a switchboard, not a form.

CALL NOW +212 5 36 60 61 50

Operating in Nigeria, Ivory Coast, or Egypt? Call the same number — our team will connect you to a local responder immediately. If you are not sure it is an incident, call anyway.

What happens when you call

Every minute is accounted for.

Minute 0

A responder answers. Not a switchboard and not a form.

0 – 15 min

We scope the incident with you: what you are seeing, what is affected, what is still running.

15 – 60 min

Immediate containment guidance, so damage stops spreading while the team mobilises.

Hour 1

A response team is assigned with a named lead, and on-site deployment is arranged if the situation needs it.

First 24 hours

Containment, evidence preservation, and an initial assessment of what happened and what was reached.

Days 2 – 5

Eradication and recovery, with a communication line to your executive team throughout.

After

A full incident report, regulatory notification support, and a hardening plan so the same route closes for good.

Before you call, if you can

Five things that help, right now.

Do not turn affected machines off. Powering down destroys evidence in memory that we may need. Disconnect from the network instead.

Do not delete anything, including files an attacker left behind. They tell us how they got in.

Write down what you have seen and when. Times matter more than you expect.

Keep discussion off the systems you suspect. Use phones or a separate channel until we know what is compromised.

If you are not sure it is an incident, call anyway. We would rather tell you it is nothing.

Regulatory notification

Several of the jurisdictions you operate in impose notification obligations with short deadlines, and those deadlines run whether or not your investigation is finished. We help you determine what must be reported, to whom, and by when, in Morocco, Nigeria, Ivory Coast, and Egypt, and under GDPR where it applies. This is part of the response, not a separate engagement.

Incident response retainers

Meet your responders before the incident, not during it.

A retainer means we already know your environment, your contacts, and your escalation path before anything happens. During an incident, that difference is measured in hours.

  • 01Guaranteed response times, written into the agreement.
  • 02An incident response plan and playbooks built and tested with your team.
  • 03An annual tabletop exercise with your executives, because the decisions during a breach are commercial as often as technical.
  • 04Retainer hours usable for proactive work if you never call on them.

Do not meet your responders during the incident. Set up a retainer.

Set up a retainer → Talk to our team