Qualification
Immediate callback: nature of the incident, affected scope, critical systems, available access, backups.
Incident Response — 24/7
Cyber Incident Response 2-hour crisis unit
Containment, investigation, remediation — a single point of contact from the first call to incident closure.
- Contain first: stop the spread before trying to understand
- Technical investigation and preservation of actionable evidence
- Immediate callback — no obligation, no online payment
Critical incident? Call now+33 7 82 70 38 30
or leave your contact details:
An expert will call you back in under 5 minutes
Describe the incident in one sentence. We'll call you back and tell you what to do immediately — free and no obligation.
150+
audited companies
SINCE 2016
72 h
first response
INCIDENT RESPONSE
1 247
vulnerabilities reported
ALL AUDITS
Included
re-test after correction
ALL OFFERS
Incident in progress
You are currently losing ground
An uncontained security incident spreads. Every hour, the attacker consolidates their access, erases their tracks, and expands their perimeter. The first decisions matter more than the subsequent ones.
- An attacker present in the system progresses while you try to qualify the incident.
- Shutting down or reinstalling too quickly destroys the evidence you will need.
- Without containment, remediation fails: the compromise returns.
- Insurance, management, clients, authorities: everyone will expect a written report.
This page is for businesses, associations, and local authorities. Cybersecurity incident response — this is not ITIL incident management or standard IT support.
Method
Our process for incident response
A proven framework, adapted to the actual scale of the incident: a full forensic investigation is not triggered for an isolated workstation.
Containment
Isolation of affected systems, cutting off compromised access, stopping the spread — before any reinstallation.
Investigation
Search for the entry point and actual scope, identification of persistent access, preservation of technical elements.
Remediation & restoration
Hardened service restoration, permanent closure of the entry point, written report for your management and your insurer.
While waiting for our call
The first 30 minutes actions
- Do not reinstall anything and do not turn off suspicious machines: isolate them from the network (unplug cable, turn off Wi-Fi).
- Cut remote access (VPN, RDP, SSH) and revoke active administrator sessions.
- Change passwords for privileged accounts from a clean workstation, never from a suspicious machine.
- Take backups offline to prevent them from being compromised as well.
- Note the time of the first symptoms and keep logs, suspicious emails, and screenshots.
- Designate a single person responsible for internal communication.
What our clients say
We don't rate ourselves.
Reviews published on our Google listing by companies that have actually been audited. Verifiable, one by one.
GOOGLE
We hired White-Hat to conduct a cybersecurity audit of all our servers, and we are very satisfied with the quality of their work. Philippe demonstrated professionalism, responsiveness, and excellent communication skills throughout the entire process. The recommendations provided were clear, relevant, and immediately actionable to strengthen our security. We highly recommend their services.
GOOGLE
Excellent experience with White-Hat for a comprehensive security audit of our SaaS platform. The quality of service was truly outstanding: Philippe took the time to understand our application's architecture before starting the tests, which made all the difference to the relevance of the results. The report was detailed, with vulnerabilities categorized by criticality, concrete evidence of exploitability, and recommendations directly applicable by our technical team. The post-delivery follow-up to verify the patches was a real bonus. Professional, rigorous, and attentive: exactly what you need to secure a SaaS product.
GOOGLE
We hired White-Hat for a comprehensive audit/advanced penetration test on our website, and it's clearly the direct contact with Philippe that makes all the difference. No salesperson between us, no unnecessary jargon: we communicate directly with someone who understands our challenges and can clearly explain the vulnerabilities found. The report was precise, with concrete evidence and recommendations that we were able to implement quickly. A truly trustworthy relationship; I highly recommend them.
GOOGLE
Professional work. Thank you.
GOOGLE
We urgently contacted White Hat following a suspected compromise of several servers. The team was extremely responsive and addressed our request within minutes, with clear communication at every stage. Their vulnerability analysis was conducted very rigorously, resulting in a detailed report and concrete, easy-to-implement recommendations to strengthen our security. The investigation of the compromised servers allowed them to quickly identify the source of the attack and contain the incident without any major disruption to our services. Professional, knowledgeable, and readily available, I highly recommend this provider for any cybersecurity intervention, especially in emergency situations.
Scope
We intervene on
Incidents handled
Ransomware, server or workstation compromise, hijacked email, data exfiltration, illegitimate administrator access, compromised website and web application.
Intervention method
Remotely as a priority, to save time. Coordination with your IT provider, your host, and your insurer.
Out of scope
No negotiation with attackers, no ransom payment, no legal advice — we work with your lawyer on these aspects.
Dedicated contact
Philippe Bécué incident response
In a crisis, you don't need a ticket number: you need someone who decides quickly and explains clearly. Philippe Bécué leads emergency interventions at White-Hat: server and email compromises, ransomware, persistent access, data exfiltration. Decisions are explained to your technical teams as well as your management, without jargon intended to impress.
FAQ
Incident response
What is your response time?
Callback is immediate during business hours and fast outside of them. The initial exchange is to qualify the incident and provide you with immediate containment measures, even before the intervention begins.
Should I turn everything off?
No. Turning off a machine destroys some of the in-memory traces and complicates the investigation. The correct action is to isolate it from the network while leaving it on, unless there is an immediate hardware risk.
Is this standard IT incident management?
No. This concerns security incident response: an attacker is or has been present in your system. The approach, tools, and precautions are entirely different from a common operational incident.
Do you provide a report?
Yes. Each intervention concludes with a written summary: what happened, the scope affected, what has been corrected, and what remains to be done. This document is designed to be shared with your management and your insurer.
Act
Incident in progress — get a callback now
Describe the incident in one sentence. We'll call you back and tell you what to do immediately — free and no obligation.
Free, confidential, no obligation — no online payment.