Engage
Describe the situation. You will be talking to the person who would run it.
There is no qualification funnel here and no junior taking notes. Describe what happened, or what you are worried about, and you get a straight answer about whether this is work the firm should be doing. If it is not, that is the answer you get.
Two ways in
Something is happening now.
Call. An active intrusion is not a form, and the first questions are better asked out loud: what you are seeing, what is still running, and what has already been touched.
If you reach voicemail, leave a number. Do not describe the incident in the message.
Everything else.
Email. Scoping an assessment, a readiness exercise, a second opinion on a report someone else wrote, or a question about a note on this site that does not turn into a sales call.
contact@alexsta-cybersecurity.com
Mon to Fri, 08:00 to 18:00 CET.
Before you write
Four lines are enough to start.
A scoping call goes faster when these are already on the table. None of them need to be complete, and a guess marked as a guess is more useful than a blank.
If any of it is sensitive, say so and leave it out. It gets picked up on the call.
The company
Where the evidence stays.
Where your data lives is a scoping decision, made explicitly and written down before anything is collected. It is not a default buried in a platform.