If you suspect ransomware, suspicious activity, cloud compromise, or malicious behavior, book immediately.
Outcome: Live triage, containment guidance, and action plan.
