Incident
Deciding what to cut, what to keep, who to prevent
When faced with a compromised account, a suspicious device or a modified page, the order matters: limit exposure, preserve evidence, change affected access, then seek the right support.