Docs → Guides & how-tos
Incident response: what to expect
What happens after you tell us something is wrong — from the first call to the plain-English summary afterward.
Last updated: August 2026
At a glance
- Urgent? Call (931) 355-7256 and say so
- Suspected compromise: call — do not email details
- One named person owns your updates throughout
- You get a plain-English summary afterward
What counts as an incident
Outage
Systems or services your team cannot work without, down or unusable.
Ransomware or malware
Anything that looks like encryption, ransom notes, or infection.
Compromised account
Sent mail you did not write, logins you do not recognize.
Unusual behavior
Systems acting strangely without an obvious explanation.
Vendor breach
A supplier tells you their systems — holding your data — were hit.
Not sure?
Report it anyway. Downgrading a false alarm is free; upgrading a late one is not.
How we respond
1
Triage & contain
Figure out what is affected and stop it spreading. Containment beats analysis — limit damage first, understand it second.
2
Keep you informed
One person owns communication with you, at a cadence we agree up front. No chasing strangers for updates.
3
Resolve & debrief
Fix, verify, and hand you a plain-English summary: what happened, what we did, what changes to prevent a repeat.
Reporting it well
What you saw — Error messages, strange behavior, exact wording where possible.
When it started — Even roughly — recency narrows the search enormously.
What changed recently — New software, new vendor, maintenance, a suspicious email.
Who is affected — One person, one team, or everyone — scope shapes response.
Suspected security incident? Call. Do not email screenshots or details of an active compromise — if an attacker is in the mailbox, they read what you send.
Common questions
Do I need to know whether it is a security incident before calling?+
No. Describing symptoms is enough — classifying the incident is our job, not yours.
Will you tell us if our data was affected?+
Yes, in plain English, as soon as we know — including what we do not know yet.
What should we tell our own team while you work?+
We give you wording you can forward — accurate, calm, and free of jargon, so rumors do not outrun facts.
Related docs
Hosting & DNS changes →
How routine change requests flow — and get verified.
Support escalation →
When something matters more than the queue knows.
Security practices →
The principles behind how we defend what we manage.
Something feels wrong right now?
Do not wait until you can describe it perfectly — call or write with what you have.