Same-day embed. We triage, stabilize, and ship the fix. You get a written post-mortem, the runbook that should have existed, and a 90-day hardening plan so it doesn’t happen again.
Rate $180 – $250 USD / hour · fixed-fee and retainer available
Emergency engagement (first 8 hours)
Triage + stabilization. You pay for hours worked, not a retainer. No minimum.
Stabilization (8–40 hours)
Root cause + immediate fixes + a written post-mortem.
Hardening retainer (3 months, post-incident)
The 90-day plan, in writing, executed. Prevents the next incident.
On-call
PagerDuty, Opsgenie, FireHydrant, incident.io
Observability
Datadog, Honeycomb, Grafana, Sentry, Lightstep
Forensics
CloudTrail, VPC flow logs, packet captures, k8s audit, custom logs
Communication
Zoom, Slack war rooms, Statuspage, dedicated incident channels
Anonymized patterns from real engagements. Client names omitted; details available under NDA.
Same-day embed. Found a connection pool exhaustion from a new background job. Killed the job, restarted, restored service. Root cause: missing max-connection limit. Fix shipped in 24h, post-mortem in 48h, runbook in a week.
Embedded within 2 hours of detection. Scoped the breach, contained the access, coordinated with the privacy officer and outside counsel. Cleared the breach notification timeline with 6 hours to spare.
Diagnosed a regional failover that didn’t actually fail over. Implemented a tested, automated failover with quarterly drills. The next regional incident recovered in 47 seconds.
Within 15 minutes for the initial triage call. We’re in your time zone (or close to it) and we don’t sleep on active incidents.
Yes — we coordinate with your security firm and outside counsel. We do the technical containment, the scoping, and the post-mortem. We do not provide legal advice.
Optional — 24/7 managed on-call with a 15-minute response SLA. Most clients use us during the 90-day hardening period, then take the pager back themselves.
Blameless, written for the team, written for the board. We turn it into action items with owners and dates, then we own following up.
Yes — quarterly or annual. We run the scenario, your team responds, we write up the gaps. Most teams find 3–5 process gaps that are cheap to fix and prevent a real incident.
A 30-minute call. No deck, no pitch — we read your repo or your architecture diagram and tell you what’s realistic.