How Many Calls Come in on a Thursday or Friday?

One of my customers, they really have worked hard on it. They got no work and had a their the infected machine off the network in 28 minutes. And even better, I bet they didn't power it off, but they left it running and got off the network. Yeah. The response is important too. A hundred percent. Like we see that and you know, not shaming anyone. Everybody's going to respond based upon the knowledge they have and what they know how to do. But if you don't have that true internal blue team expertise or that true internal forensic expertise and you try to hold on to something for two or three days... You're losing artifacts.