Summary
If our detection systems catch a client account takeover, the account is locked and every session is signed out automatically. We investigate what happened, restore access and give you a full incident report.
If it's happening right now, call 647-547-5473. After hours, press 9 to reach whoever is on call.
What happens automatically if you're a client?
Two systems watch your accounts in parallel: identity threat detection and email compromise detection. When either detects a takeover, it locks the account and signs out every session automatically.
A 24/7 security operations team passes the incident to us, usually before you notice anything. Severity 1 alerts page whoever is on call. The team also contacts us by text, email or phone when it needs us to act.
If you suspect something has slipped past, contact us by phone, through the Teclara Support Portal or at support@teclara.tech. Reply times are based on your service agreement (SLA).
What if you're not a client yet?
Call us to start incident response. We send a short incident response agreement that gives us permission to act. You create a Super Admin account for us. We then sign in and start the investigation.
What do we check?
We scan your whole Google Workspace environment, check the mailbox you use in Gmail, and read sign-in and activity logs to see how far the attacker got.
| Field | Value |
|---|---|
| Identity | Sign-ins, authentication methods, recovery details, administrator changes and unfamiliar devices. |
| Inbox and forwarding rules, delegates, sent and deleted messages, and delivery records. | |
| Applications | Third-party app grants and other authorized connections. |
| Data | Google Drive and shared drive activity, including downloads and sharing changes. |
| Devices | The device used during the compromise, checked before the person signs in again. |
How do we use AI during the investigation?
We use AI to help with the investigation while the attacker is still inside. Reviewing the information manually would take days.
An AI assistant reviews configuration only: settings, policies, access rules and how cloud apps are set up. This configuration information does not include personal information.
Logs can contain personal information. We analyze them only on our own private AI models. We never send them to an outside AI service.
How does the person get back in?
- We reset the password and multi-factor authentication, the extra verification used at sign-in. We also remove every registered sign-in device.
- The person receives a temporary password by encrypted message.
- They change the password at first sign-in and set up multi-factor authentication again.
What can you do while you wait?
Call us if you suspect a takeover. You do not need to be certain.
If you are an administrator and the account is not locked yet, suspend the account from a trusted administrator session.
If the password was reused elsewhere, change it on every affected system. Start with administrator and financial access.
What do you get afterwards?
You receive a full incident report. It explains what happened, how far it reached, and what we did to contain and fix it.