Use cases
- A privileged or business-critical account shows suspicious sign-in or configuration activity.
- Business email compromise, malicious forwarding, payment-change fraud, or mailbox abuse is suspected.
- A website, cloud platform, or administrative account may have been altered without authorization.
- The organization needs help structuring containment, evidence preservation, recovery, and follow-up.
Review surface
- Available account, mailbox, identity, cloud, or website evidence within scope
- Known timeline, suspicious changes, alerts, sign-ins, forwarding, delegation, and privileged activity
- Containment decisions and dependencies that could destroy evidence or interrupt business operations
- Recovery paths, account control, third-party involvement, and follow-up monitoring needs
- Post-incident control gaps that contributed to impact or delayed response
Method
Deliverables
- Initial triage and response priorities
- Containment and evidence-preservation guidance
- Recovery and hardening recommendations
- Incident timeline or response notes where in scope
- Post-incident recommendations
Practice context
Blackpine maintains a dedicated Incident Response & Triage function, including incident leadership, digital forensics, email-compromise work, and response coordination.
Compromised mailbox
Suspicious external forwarding and unfamiliar sign-in activity appear after a credential event.
Messages may have been exposed and the account could be used for further impersonation.
Preserve relevant evidence, regain account control, review sessions and recovery methods, investigate forwarding/delegation, and assess downstream impact before closing the incident.
Scope
The website form is not a 24/7 emergency service. Availability, scope, response time, and specialist requirements are confirmed during intake. Do not submit passwords, keys, regulated records, or sensitive evidence through the public form.