Brand Protection

Mitigation

Purpose

Mitigation tracks the active takedown and remediation process for every Incident — from the moment a takedown request is sent to a third party (hosting provider, domain registrar, social platform, app store, marketplace, ad network) until the threat is confirmed removed. This is where Brand Protection moves from "we know about it" to "it's gone."

Core concepts

  • Incident — the promoted, confirmed threat that Mitigation acts on. Has Overview, Evidence, Duration, and Progress views.
  • Takedown request — the outbound action sent to the responsible party (abuse report, DMCA/copyright notice, platform report, registrar complaint, app store report, ad network report).
  • Takedown lifecycle — the tracked stages a request moves through, from drafting to verified removal.
  • Duration tracking — time-to-detect, time-to-report, and time-to-resolve metrics per incident, rolled up for SLA reporting.
  • Quick actions — common operator actions surfaced directly on the incident (escalate, resend, mark resolved, request a status update from the provider).
  • Escalation — when a provider doesn't respond within SLA, the request is automatically or manually escalated (e.g., resent, sent to a secondary contact, or escalated to legal).

Takedown lifecycle

flowchart LR
    A[Incident Promoted] --> B[Takedown Request Drafted]
    B --> C[Sent to Provider/Platform]
    C --> D{Provider Response}
    D -->|Acknowledged| E[In Progress]
    D -->|No response / SLA breach| F[Escalate / Resend]
    F --> C
    E --> G{Content Removed?}
    G -->|Yes| H[Verify takedown]
    G -->|No, still live| F
    H --> I[Resolved / Closed]

Why takedown speed matters

xychart-beta
    title "Estimated Customer Impact vs. Days Live (Phishing Page Example)"
    x-axis [Day1, Day2, Day3, Day4, Day5, Day6, Day7]
    y-axis "Estimated Victims" 0 --> 500
    line [20, 65, 140, 230, 310, 400, 480]

Phishing and scam pages tend to see accelerating (not linear) harm the longer they stay live, since they get indexed, shared, and picked up by more victims over time. This is why Mitigation tracks time-to-resolve as closely as it tracks total incident count.

Incident panes

  • Overview — summary of the threat, classification, severity, and current mitigation status.
  • Evidence — screenshots and supporting data used in the takedown request (critical for provider/registrar acceptance and for any legal follow-up).
  • Duration — how long the incident has been open, broken down by stage (detection → promotion → request sent → resolved).
  • Progress — a timeline of every status change and communication sent, serving as the audit trail for the incident.

SLA breakdown (example)

pie showData
    title Incidents by SLA Status (Example)
    "Within SLA" : 68
    "At risk (>75% of SLA elapsed)" : 17
    "Breached SLA" : 15

Typical use

  • Monitor the Mitigation queue for incidents stuck "in progress" past your SLA and escalate promptly — providers are far more likely to act quickly on repeated, well-documented requests.
  • Use the Progress timeline as the audit trail for compliance and legal reporting.
  • Duration metrics from this page feed the Mitigation Status section of generated Brand Protection reports.
  • Prioritize takedowns by impact (traffic, followers, downloads) as well as severity — a lower-severity but high-traffic scam page may deserve faster action than a higher-severity but low-visibility one.