Duress Hotline: The Phone Line in Front of the SOC

Field notes

The service separates urgent client calling from a security operation's own network, using per-client DIDs and severity-based routing to identify and direct escalations. Its stated workflow moves from the on-call analyst to backup contacts and then a SOC manager after 30 seconds, while outbound alerts continue until a keypress acknowledgement is recorded. The page also describes ticket-linked call recordings, geo-blocking, spend caps, anomaly alerts, and capacity intended to withstand telephony denial-of-service traffic.