Incident containment
Stop the spread. Isolate what is still talking to an attacker. Reset the credentials that matter.
Emergency incident response
If the business is locked out, call now.
Ransomware, a tenant you no longer trust, email that is sending as you, servers that will not boot, or backups you are afraid to restore. Avery Parker treats that as an emergency: contain it, get operations back, then close the hole. This is principal-led work — not a ticket queue.
Avery Parker · principal
Support since the early 1990s
Networks & security since the late 1990s
Linux since ~2000
Johnson City office · you talk to the same person
What to do in the first hour
- Call us. Do not wait to finish a written timeline.
- Do not power-cycle everything “to see if it comes back.”
- Have someone with admin access on the call.
- Have someone who can approve spend on the call.
- If counsel is involved, they can join from the first conversation. We treat it as confidential.
We scope the first block of work after that call. Emergency response is a project, not a monthly package. Ongoing vCISO or managed IT comes after the environment is livable.
A written discovery intake is what we walk through on that first call. Pricing is quoted after discovery — not published as a rate card.
What we handle
Ransomware recovery
Restore from known-good backups where they exist. Rebuild where they do not. Get the business operating again.
Compromise assessment
Find leftover access: VPN, RDP, Microsoft 365, planted admin accounts, forwarding rules — not just the locker screen.
Endpoint protection / EDR
Real detection on the machines that still matter, not a leftover antivirus checkbox.
Identity & email
Microsoft 365, MFA, privileged access, and the mailbox paths used in business-email compromise.
Security overhaul
Backups that restore, network rules that are honest, logging you can read, and a 30/60/90 plan.
How we price this
This is not hourly. We price the environment: machines, servers, sites, and accounts. You are buying the outcome and someone who will still pick up — not a timesheet.
Discovery call
What is down, what still works, who has authority, how many computers, servers, locations, and people are involved, and whether email is in scope.
Phase 1 — Contain and get you operating
Stop the spread, reset what is owned, restore the systems the business cannot wait on, and write down what we know and do not know.
Phase 2 — Lock it down so it does not reopen
EDR on remaining machines, identity and MFA cleanup, backups that restore, network rules that are honest, and a 30/60/90 plan.
Stay, if you want us
Managed IT or a vCISO retainer once operations are stable. That is a separate conversation, on purpose.
If we find a second site, dead backups, or an attacker still inside, we stop and change the scope. We do not silently eat it or pad a timesheet. You get a written estimate after discovery — a range, and a not-to-exceed unless we both agree to a change.
If you have cyber insurance, call the number on the policy as well. We can still contain and rebuild. A carrier may require their own forensic firm for the investigation invoice.
Who this is for — and who sits with us
Owners, counsel, operators
You need the business operating this week and a written picture of what we know. You do not need a national logo on a $150k forensic invoice unless your carrier is buying that separately.
In-house IT
You already know the building. We add surge, after-hours, and a senior pair of hands. We do not sideline you or go around you to the owner unless you ask.
Out-of-town MSPs
You stay the provider of record. We are boots on the ground in the Tri-Cities or WNC. How partner IR is scoped →
It is only the WordPress site
Gambling links, spam titles, a user you did not create — and the rest of the business is fine. That is the published hacked WordPress job, not this page.
Who does the work
Incident work at this price is not a ticket queue. It is Avery Parker — the same person who has been on Windows desks since the early 1990s, on networks and security since the late 1990s, and on Linux servers since around 2000.
Experience you can date
- Early 1990s — computer support and repair
- Late 1990s — networking and security
- Around 2000 — Linux server administration
- Web, hosting, and search alongside the infrastructure work ever since
Local and accountable
Office at 4100 North Roan Street, Suite 208, Johnson City, TN 37604. Onsite across the Tri-Cities and Western North Carolina. You talk to Avery, not a tier-1 queue. Retainers are month-to-month. We do not sell you a stack we are paid to push — vendor-neutral advice.
How coverage works (one principal, not a fake bench)
This is Avery Parker’s practice. Scheduled work is booked. Incident response jumps the queue. If he is already on a site, you hear that on the first call — not after you have waited. Partner MSPs get a scoped window in writing. We do not invent a second-shift team we do not have.
Published, not just a résumé line
- Avery J. Parker — Tech archive — Windows, Linux, security, hardware
- Network Ninja series — Linux & Windows admin, networking, security tools
- DefensibleScore — SPRS defensibility check for CMMC / 800-171
- TerraScore — Land & site intelligence
- Trileaf Hosting — Linux hosting and infrastructure
- Tri-Cities TN Guide — Local business directory — a DTS project
Questions we get
Should we call you or the insurance company first?
If you have a cyber policy, call the number on it as well. We can still contain and rebuild. A carrier may require their own forensic firm for the investigation invoice. Do not wait on a perfect panel assignment to isolate what is still talking to an attacker.
Is counsel on the first call?
If a lawyer is involved, they can join from the first conversation. We treat it as confidential. Many small businesses do not have counsel on day one; we still take the call.
Is this hourly?
No. We price the environment after discovery: machines, servers, sites, and accounts. You get a written range and a not-to-exceed unless we both agree to a change.
What if you are already on another job?
You hear that on the first call. Incident work jumps the scheduled queue. We do not pretend to have a second-shift bench we do not have.
Do not wait for a perfect inventory.
Tri-Cities 423-888-0252 · Western NC 828-484-1257