Siren. Duck. Cover. All Clear.
The same four steps, whether it's a phishing email that got clicked or a full ransomware event. Practiced enough in advance that nobody's inventing a plan while the building's metaphorically on fire.
The Siren
Something trips a wire — one of our feeds, one of your systems, occasionally a very alert intern. Either way, the siren goes off, and it goes off for us, not just for you.
Duck
First, we get low. Contain what's spreading, cut off what needs cutting, and figure out exactly how bad "bad" actually is, before anyone starts making confident statements about it.
Cover
Then we cover the actual ground — full investigation, root cause, what got in, what it touched, and what it would take to make sure it doesn't happen the same way twice.
All Clear
A plain-English report, a list of what to fix, and — this part matters — an actual phone call, not just a PDF, to walk through what happened and what's next.
Because the first time should never be the real thing.
Clients on The Bunker retainer run this exact sequence at least twice a year on a fake incident, so that when a real one shows up, everyone in the room has already done this before — including us. The siren sounds the same either way.