Have you detected anomalous or suspicious activity on your network?

Are you currently experiencing a ransomware attack?

Are you detecting confirmed or potential Indicators of Compromise (IOCs)?

Do you suspect your organization has been breached — or have you received a notification of breach?

Have critical systems become inaccessible or encrypted without explanation?

Are endpoint detection tools flagging high-severity threats or active exploits?

Have internal security teams escalated an alert requiring forensic investigation?

Are your logs showing unusual login attempts, privilege escalations, or lateral movement?

Has a third party (e.g., vendor, law enforcement, or client) alerted you to a potential compromise?

Do you require immediate Digital Forensics and Incident Response (DFIR) assistance to investigate or contain a security event?