Operational playbook · All operators

What to do after a compromised website

Contain, investigate, remediate, evidence, learn.

Order of operations

Contain (access / WAF / take offline if needed)
Investigate with AI + logs
Remediate under approval
Verify and capture evidence
Update Standards to prevent recurrence