Incident Response
Containment, investigation and clean-up after a suspected account takeover or email compromise.
Contact hours: Monday to Friday, 9:00 a.m. to 5:00 p.m. ET. For an active incident outside those hours, call +1 (647) 547-5473 and press 9 to forward your call to Wadhah's mobile. Before response work starts, we confirm we’re available and what the work involves.
Send a message or email hello@teclara.tech
Request an urgent callback
Leave your number and a line about what is happening, and we will call you back as quickly as we can. To reach us straight away, call +1 (647) 547-5473 and press 9.
Help with a suspected account takeover or email compromise in Microsoft 365 or Google Workspace. The attacker is locked out, the records are investigated, and the gap that let them in is closed.
On the first call we check this is the right project and talk about timing. You get a fixed price and a start date before any work begins.
- Duration
- Depends on the incident
- Type
- Response
What you get
Depending on the project, you get findings and recommendations, changes made to your systems, or both. The documentation is yours to keep, whatever you decide next.
Containment
Active sessions revoked, passwords and sign-in methods reset, and the attacker's foothold removed, including forwarding rules, mailbox rules, and connected applications.
Investigation timeline
Sign-ins, sessions, mailbox changes, app access and affected files in one timeline, showing what the evidence says the attacker reached.
Clean-up and hardening
The weakness that let the attacker in is closed, whether that was missing MFA, a legacy sign-in path, or unnecessary administrator privileges.
Ongoing security recommendations
A plan to bring the cleaned environment into Managed Security & Compliance, so sign-ins, email, and devices are watched by a human-led team from then on.
Questions about timing or fit?
Call about an active incidentProject steps
Nothing in your systems changes until the tasks and access have been agreed with you.
First call
The first call covers the platform, the affected accounts and who can give us admin access.
Containment
Active sessions are ended, passwords and sign-in methods are reset, and anything the attacker set up to keep access is removed.
Investigation
Sign-in, mailbox and app records are checked to work out what was accessed, sent or changed.
Clean-up and hardening
Unauthorized changes are removed and the weaknesses that allowed the attack are fixed.
Handoff
You receive the investigation timeline, a record of every change and recommendations for ongoing security.
When this project helps
A staff mailbox is sending messages nobody on the team wrote
A client or supplier received a payment or banking change request that your business did not send
Someone approved a sign-in prompt they did not start
Forwarding rules, mailbox rules, or connected apps appeared that nobody set up
Frequently asked questions.
Is ongoing monitoring included?
No. This project deals with the incident itself. Ongoing monitoring and response come with Managed Security & Compliance, which is a separate service.
Who makes legal, insurance and notification decisions?
Your own advisers and leadership. Decisions about legal steps, insurance claims, privacy reporting and telling clients stay with them, and the investigation timeline gives them the facts to work from.
Need help now?
Call and tell us what is happening. Before response work starts, we confirm we are available and what access is needed.