When this fits
- An employee sees an unexpected MFA prompt.
- A login appears from an unfamiliar location or device.
- A security alert does not have a clear owner or explanation.
- An employee forwards a suspicious email for review.
- A device, cloud account, or network event behaves differently from normal.
Narrow uncertainty before making disruptive changes.
Blackpine starts with the observable facts, available evidence, affected systems, and business context. The investigation can remain focused when the issue is benign or escalate into incident response, digital forensics, recovery, or other specialist work when the evidence supports it.
What Blackpine can provide
Engagement models
Pay-as-needed work for organizations that do not have a recurring Blackpine subscription.
Pre-established incident-response relationship intended to reduce contracting and environment-discovery friction during an incident.
Recurring security relationship covering agreed monitoring, endpoint protection, vulnerability management, account review, Security Desk support, and reporting.
Boundary
Investigation scope depends on the evidence Blackpine is authorized to review. A suspicious signal is not automatically treated as proof of compromise.