Establish authority
Name the incident lead, decision-makers and a protected communication channel. Record the time, source and reason for every significant action.
Cyber incident supportUnder attack?
Under attack?
Start here.
If you suspect a breach, ransomware, account takeover or active fraud, act deliberately. Preserve evidence, protect critical access and give decision-makers a clear route to coordinate.
Submitting this form does not guarantee immediate or 24-hour response. Capability and availability are confirmed after review.Use a known-clean device and a channel that may not depend on the affected environment. Do not send passwords, private keys, malware files or bulk personal information through this form.
Reduce harm without
destroying the evidence.
Every incident is different. These are stabilising principles, not a substitute for authorised technical, legal or regulatory advice.
Preserve what matters
Avoid wiping, reimaging or casually restarting affected systems. Preserve logs, alerts, suspicious messages and relevant timestamps before they disappear.
Contain with care
If spread or active misuse is visible, isolate affected access or devices where it is safe and authorised. Avoid broad shutdowns that could increase harm.
Protect critical access
Use a trusted path to secure privileged identities, revoke exposed sessions and protect recovery accounts. Do not make these changes from a suspected device.
A disciplined response pathFrom uncertain signal
From uncertain signal
to safer operations.
Where an incident fits available capability and an engagement is agreed, response work is scoped around authority, evidence, business impact and controlled recovery.
- 01
Triage the situation
Establish what is known, what remains uncertain, which services are at risk and who may authorise disruptive action.
- 02
Constrain the threat
Reduce attacker access and propagation while protecting critical operations and preserving investigative options.
- 03
Understand the path
Connect identity, endpoint, cloud, email and network evidence to determine scope, persistence and material impact.
- 04
Recover and validate
Restore services in priority order, verify that access and configurations are trustworthy, and record unresolved exposure.
Secure incident request
Tell us what is happening.
Use short, factual details: when the concern began, which systems or accounts may be affected, what is still operating and which actions have already been taken.
Do not includePasswords or recovery codesPrivate keys or access tokensMalware samples or confidential datasets
If there is an immediate threat to physical safety, contact the appropriate emergency services. For suspected payment fraud, contact the relevant financial institution through a verified channel without delay. Legal, regulatory and insurance decisions should be coordinated with qualified advisers and applicable policies.