Incident Response
Contain a suspected account compromise, investigate its impact, and address the security gaps that allowed it.
Or email hello@teclara.tech
Incident response for suspected account takeover, business email compromise, or other active incidents in Microsoft 365 or Google Workspace. We contain affected accounts, investigate access and activity, remove unauthorized access, and address the security gaps identified. After remediation, Managed Security & Compliance is available for ongoing monitoring and response.
Price is quoted after scope confirmation. The first call establishes fit, required access, and timing. Confirm the start date and required preparation with us before relying on the duration below for a deadline.
- Duration
- Scoped to the incident
- Engagement
- Response
Output
What you receive
You receive documented findings or implemented changes, as defined in the scope. The documentation remains yours whether or not you continue with Teclara.
Containment
Active sessions revoked, passwords and sign-in methods reset, and the attacker's foothold removed, including forwarding rules, mailbox rules, and connected applications.
Investigation timeline
Sign-ins, sessions, mailbox changes, application access, and affected files placed in one timeline, so you can see what the attacker accessed and when.
Clean-up and hardening
The weakness that let the attacker in is closed, whether that was missing MFA, a legacy sign-in path, or unnecessary administrator privileges.
Ongoing security recommendations
A plan to bring the cleaned environment into Managed Security & Compliance, so sign-ins, email, and devices are watched by a human-led team from then on.
How it works
Project steps
We agree on the tasks and required access before making changes to your systems.
First call
Tell us what you are seeing. We confirm the platform, who can grant administrative access, and which accounts may be affected.
Containment
We cut off the attacker's access first: sessions, credentials, sign-in methods, and anything they configured to keep a way back in.
Investigation
We work through the sign-in, mailbox, and application records to establish what was accessed, sent, or changed.
Clean-up and hardening
We remove what the attacker left behind and fix the control that failed, to reduce the risk of another compromise.
Handoff
You get the timeline, a record of what changed, and recommendations for ongoing security management. Legal, insurance, privacy, and client notification decisions stay with your counsel, insurer, and leadership.
Best fit
When this engagement is useful
A staff mailbox is sending messages nobody on the team wrote
A client or supplier received a payment or banking change request that did not come from you
Someone approved a sign-in prompt they did not start
Forwarding rules, mailbox rules, or connected apps appeared that nobody set up
Ransomware or unfamiliar activity has appeared on a work device
Short on time? Let your favourite AI sum up Teclara.
Ready to start?
Book the first call. We will confirm the situation, the access required, and whether this engagement is the right starting point.