Request demo
Log inRequest demo

Responders on call 24/7

Emergency incident response for cloud, identity and SaaS attacks

Exaforce provides 24/7 emergency incident response (IR) for organizations under active attack. A responder answers within 15 minutes. You do not need a retainer, and you do not need to be an Exaforce customer.

Report an incidentCall +1 (844) 660-1663

What you can expect

  • 15 minFirst response, 24/7
  • 24 hLive in your environment
  • 30 daysOf identity, cloud and VPN logs replayed
  • 24/7Managed detection and response until the incident is contained

What happens in the first 24 hours

We are live in your environment within 24 hours, replay the last 30 days of your identity, cloud and VPN logs, and run 24/7 managed detection and response until the incident is contained.

  1. 01 / 0 to 15 min

    A responder answers

    You tell us what you see. We agree on the first containment steps and on who can approve actions.

  2. 02 / 1 to 24 h

    Emergency onboarding

    We connect your identity provider, cloud accounts, SaaS applications and VPN. There is no sales cycle.

  3. 03 / On connection

    30-day log replay

    Exaforce replays the last 30 days of logs. AI agents, called Exabots, investigate each event and build the timeline: how the attacker got in, what they touched and what they still control.

  4. 04 / Until contained

    Respond and coordinate

    Our analysts monitor and respond 24/7. Your team and ours work in one shared War Room that syncs to Slack. You approve containment actions from a laptop or a phone.

What is included

  • Emergency onboarding within 24 hours, for any organization
  • 30-day replay of identity, cloud and VPN logs
  • 24/7 managed detection and response for the duration of the incident
  • A shared War Room for your team and ours, synced to Slack
  • Breach notification support: evidence, scope and timelines for your counsel and insurer

What is not included

  • Forensic disk imaging and on-site response
  • Legal counsel and ransom negotiation
  • Public relations and crisis communications

We state the limits so that you can line up the right partners early. We work next to your breach counsel, your insurer and your forensic firm.

Incident response retainer

A retainer removes the onboarding step. Your data sources are connected before an incident, so the investigation starts on the first call.

 EmergencyNo retainerRetainer
First responseWithin 15 minutesWithin 15 minutes, contractual SLA
Time to live investigationWithin 24 hoursImmediate. Sources are already connected.
Agreement and contactsSigned during the incidentIn place. Named contacts can activate 24/7.
Talk to us about a retainer

Emergency response or retainer: which one do you need?

If you are under attack now, call. A retainer is not required. If you are not under attack, a retainer is the faster option for the next incident. Contracts, contacts and log access are already in place, and those are the steps that cost the most time in the first day.

After the incident

When the incident is contained, we hand over the timeline, the evidence and the list of actions taken. Many organizations then keep the same data and tooling and move to Exaforce MDR for continuous 24/7 coverage.

Frequently asked questions

Do I need a retainer to get emergency incident response from Exaforce?
No. Exaforce accepts emergency engagements from any organization, with no retainer and no existing contract.
How fast does Exaforce respond to an incident?
A responder answers within 15 minutes, 24 hours a day. Exaforce is live in your environment within 24 hours. Retainer customers skip onboarding, so the investigation starts on the first call.
What types of incidents does Exaforce handle?
Attacks on identity, cloud and SaaS: account takeover, session and token theft, business email compromise, cloud account compromise, insider activity and supply chain compromise through SaaS or code repositories.
Which systems does Exaforce connect to?
Identity providers, cloud platforms (AWS, Google Cloud, Azure), SaaS applications, VPN, endpoint and email tools. See the integrations list at exaforce.com/platform/integrations.
What is the 30-day log replay?
Exaforce reads the last 30 days of your identity, cloud and VPN logs and investigates every event. The result is a timeline of the attack with the evidence behind each finding.
Does Exaforce do forensic imaging or ransom negotiation?
No. Exaforce does not do disk imaging, on-site response, legal counsel, ransom negotiation or public relations. We work with the firms you choose for those.
Will Exaforce work with our cyber insurer and breach counsel?
Yes. We provide the evidence, scope and timelines that counsel and insurers need for notification decisions.
What is the difference between incident response and MDR?
Incident response handles one active incident until it is contained. Managed detection and response (MDR) is continuous 24/7 monitoring, investigation and response. Exaforce runs MDR during the incident and can continue it after.