Incident response
How GNT Security handles security incidents and major outages, how to report one, and what falls outside normal managed scope.
What counts as an incident
An incident is any event that threatens the confidentiality, integrity or availability of systems or data, or significantly interrupts normal operations.
- Suspected or confirmed malware or ransomware
- Unauthorized access to accounts, devices or data
- A major outage of core systems or network infrastructure
- Data loss or corruption affecting important information
- Misconfigurations that expose systems to risk
How to report an incident
Report incidents as soon as you notice them. Share what you know, but do not delay while you gather more information.
Phone: (510) 469-0947
Email: support@gntsecurity.com
Client portal: portal.gntsecurity.com
Suspected account compromise
Do not email us from the account you think is compromised. Call, or use a different account.
Response for managed clients
For environments covered by a managed service agreement, incident response starts as part of the service, using the same tools and access we use every day.
- Rapid remote assessment of affected systems
- Isolation or containment of compromised devices where possible
- Use of existing monitoring, logging and backups
- Prioritization based on impact and risk
- Findings and next steps explained in plain language
Specific timeframes are governed by your service agreement.
Typical response steps
- Confirm the details and impact with the person who reported it.
- Stabilize systems by isolating or disabling affected components.
- Identify the likely cause and entry point from the available data.
- Restore services from clean backups or known-good states.
- Make targeted changes to reduce the chance of a repeat.
- Summarize what happened and what changed.
Billable incident work
Some incident work falls outside normal managed scope and may be billed separately:
- Work on systems not enrolled in management
- Forensics and deep log analysis beyond standard review
- Large rebuilds or redesigns after an incident
- Emergency work outside agreed service hours, if not covered
- Legal, compliance or third-party coordination beyond IT scope
Where possible, billable work is discussed and approved before significant time is spent. When immediate action is needed to prevent further harm, we act first and explain afterwards.
Your responsibilities during an incident
- Report incidents immediately, even with incomplete details.
- Do not delete logs, alerts or suspicious emails before they are reviewed.
- Avoid major configuration changes without coordinating with us.
- Make decision makers reachable when fast approval is needed.
- Follow post-incident recommendations to reduce future risk.