Who answers in the first hour if the site starts behaving oddly

Saturday, the site opens and then does not, the admin panel has an unfamiliar user, the accountant writes that mail is asking for a password. The chat has three pieces of advice: reinstall, change every password at once, "wait until Monday". Each piece of advice is sometimes right on its own. Together they wipe the traces and leave the way in. The first hour is not for heroics. It is for not making it worse.

A short order that fits on half a page

• One person decides whether to touch the site. Not the whole chat.
• Write down what is visible: the address, the time, a screenshot, the letter. Do not delete it "so people are not scared".
• If money or other people's orders are leaving, stop that window, not the whole company internet.
• Call the person who is allowed, by contract, to enter the host. Improvising with a password from a spreadsheet is often the second hit.

Having this list before the incident matters more than buying another product. Access should not live in one head: the registrar, the host, mail. Monitoring is useful because it wakes this person at night. Without a person it wakes an empty room.

Lexora joins as incident response when the event is already underway, and writes the channel into the monitoring contract in advance. We do not promise a round-the-clock headquarters that a small company does not have and that we do not have in that form either. We promise a clear contact, a boundary of work and a record of what was touched. The later review, whether a pentest is needed or a weak password was enough, is separate, so the first night is not used to sell extras. For new clients a calm basic audit before an incident is still free.