When this fits
- A Microsoft 365 or Google Workspace account was taken over.
- An administrator is locked out or recovery details were changed.
- Sessions, tokens, forwarding rules, delegates, or other persistence need review.
- Systems need to be restored after an incident.
- Credentials and access paths need to be rotated and validated.
Recovery is more than changing a password.
The recovery path should establish who controls the affected system now, which sessions or persistence mechanisms remain, what needs to be restored, and which security controls should change before normal operation resumes. Blackpine can connect that work to the incident findings rather than treating recovery as an isolated reset.
What Blackpine can provide
Engagement models
Pay-as-needed work for organizations that do not have a recurring Blackpine subscription.
Pre-established incident-response relationship intended to reduce contracting and environment-discovery friction during an incident.
Boundary
Recovery outcomes depend on the affected technology, available evidence, access authority, third-party dependencies, and the condition of backups or recovery paths. Blackpine does not represent recovery as guaranteed.