Talk to an investigator, not an inbox
Live incidents get a person inside the hour. Everything else gets a straight answer within one business day about whether we are the right firm for it.
- Response on live incidents
- < 1 hr
- Incident duty rota
- 24/7
- Response on everything else
- 1 day
- Signed before anything sensitive
- NDA
Something moved that should not have
Give us what you have. The first call establishes what happened, what is still exposed and whether tracing can realistically recover anything, all before you commit to a retainer.
- Investigator on a call, not a sales sequence
- Evidence preserved before it decays
- First hop map inside twenty-four hours
Book a scoping call
Assessments, advisory programmes and training cohorts all start the same way: thirty minutes to understand the scope, then a fixed price and a start date. No discovery invoice.
- Assessments
- Fixed scope, fixed price, quoted after the call
- Advisory
- Monthly retainer or project, your choice
- Training
- Priced per cohort of up to sixteen
The things worth knowing first
Whatever you already have, even if it is fragmentary. Transaction hashes, approximate value, the time you noticed and which systems the affected keys touched. Missing detail does not delay intake. Waiting until you have all of it does.
Usually yes, and quickly, to keys generated on a clean device. Tell us afterwards so we can distinguish your own rescue transactions from the attacker's. Otherwise those movements muddy the trace and cost time to unpick.
Happily, and we can send ours in minutes if you do not have a preferred form. The first call is confidential regardless of whether paper has been signed yet.
For losses of meaningful size, yes. Below a certain threshold the honest answer is that our fees would consume more than a realistic recovery, and we will tell you that on the first call rather than after an invoice.
Value moving right now?
Do not fill in a form. The duty rota answers around the clock and the first hour is the one that matters.