// The Next 30 Minutes

What to do while you wait for us

Most of the damage in a breach happens in the first hours, and so do most of the mistakes that make recovery harder. Do the things on the left. Avoid the things on the right.

Do this

Disconnect affected machines from the network. Unplug the cable or turn off Wi-Fi. Leave them powered on.
Write down what you saw and when. Ransom note, odd emails, locked files, a login alert. Photos of screens are fine.
Change the passwords of anyone who reported something from a different, trusted device, and revoke their active sessions if you know how.
Tell your IT provider we're coming so nobody wipes and rebuilds before we've looked.
Find your cyber insurance policy and your broker's number. Many policies require you to notify them early.
Pick one person to coordinate so instructions aren't coming from five directions.

Don't do this

Don't power off or reboot. Memory holds evidence of what ran and where it came from. Once it's gone, it's gone.
Don't wipe, reimage, or restore from backup until the entry point is known. Restoring onto an open door means doing this twice.
Don't pay a ransom or reply to the attacker before speaking to us and your insurer. Negotiation, if any, is a decision for later and a specialist.
Don't run "cleanup" tools or delete suspicious files. You may destroy the trail we need to prove what was and wasn't taken.
Don't email the whole firm about it from a mailbox that may be compromised. The attacker may be reading.
Don't assume it's over because the screen went back to normal. Quiet is not the same as gone.

// When You Call

What happens next

No forms, no sales handoff. This is the sequence from the first ring to the final report.

1

Triage call

A senior responder asks what you're seeing, what's affected, and what you've already done. You get an honest read of severity and an immediate action list.

First 15 minutes · no charge

2

Terms in writing

A short engagement letter with the scope, hourly rate, and initial estimate lands in your inbox. Nothing billable starts until you say go.

Within the hour

3

Containment

We shut the attacker's access: sessions revoked, accounts locked, malicious rules and persistence removed, affected systems isolated. Evidence is preserved as we go.

Same day, usually remote

4

Investigation and recovery

How they got in, what they touched, what left the building. You get a daily plain-English update, then a final report your insurer, lawyer, and regulator can use.

Days, not weeks

// What We Handle

The incidents that actually hit small firms

Most of our work is in Microsoft 365 environments at professional-services firms. These are the calls we take most often.

Business email compromise

An attacker inside a mailbox, redirecting invoices or client payments. The most common way accounting and law firms actually lose money.

Ransomware

Encrypted files, a ransom note, and a clock. We contain, assess what was taken, and get you to a clean recovery path.

Account takeover

A Microsoft 365 sign-in from somewhere it shouldn't be, an MFA prompt someone approved, a forwarding rule nobody created.

Data theft and extortion

Client files exfiltrated with a threat to publish. We establish what left, advise on obligations under PIPEDA, and support your counsel.

Malware on endpoints

A trojan from a fake court notice or CRA letter. We find every machine it reached, not just the one that raised the alarm.

Insider and departing-staff risk

Files copied to personal drives before a resignation. Forensic preservation and a defensible timeline for HR and legal.

// Two Ways to Engage

Call us cold, or have us on speed dial

Emergency engagement

No prior relationship needed

Free triage call, day or night
Hourly billing with terms and an estimate in writing before work starts
No minimum commitment and no retainer required
Remote response starts the same day across Canada
Final report suitable for insurers, counsel, and regulators

Call the emergency line

Incident response retainer

Recommended for firms with client data

Guaranteed response time and a team that already knows your environment
Pre-negotiated rates, so nobody is signing paperwork at 2am
Annual readiness review: playbook, contacts, and a tabletop walkthrough
Unused hours roll into proactive work such as a Pulse posture review
Satisfies the "incident response plan" line on most cyber insurance applications (check the other eleven)

Ask about a retainer

// Working With Your Other Partners

Your insurer, your IT provider, your lawyer

If you have cyber insurance, tell us on the first call. Most policies want early notice and some assign a breach coach or preferred vendors. We work alongside whoever the carrier brings in, hand over evidence cleanly, and write reports in the format adjusters expect. Calling us first does not jeopardize your claim; delaying notice to the insurer can.

If you have an IT provider, we don't replace them. They know your systems; we know attackers. We give them clear, specific instructions for containment and rebuild, and we keep them in every update so nothing is undone by accident.

If you have a lawyer, ask them whether the investigation should run under privilege. We're used to working that way and can be engaged through counsel.

// One Number

Ten minutes now beats ten days later

If you're not sure whether what you're seeing is an incident, that is exactly the call to make. Nobody has ever been charged for the triage call.

Call +1 (647) 403-3620 Email connect@cyberelixir.ca

Under attack right now?