Incident response
Ransomware, fraud, compromised accounts or a data leak: we pick up immediately, contain the attack, restore operations and handle notifications to the authorities.
- Immediate containment
- Forensics
- Recovery
- Notifications
- until you speak to an operator
- 15 min
- until you speak to an operator
- to have someone inside your network
- < 30 min
- to have someone inside your network
- all year round, holidays included
- 24/7
- all year round, holidays included
In detail
Once it has happened, the first hours are what matters.
In a serious incident every hour counts: to stop the spread, preserve evidence and meet legal deadlines. NIS2 requires an early warning within 24 hours and a full notification within 72; GDPR requires notifying the authority within 72 hours if personal data is affected.
Our team connects remotely in under an hour and comes on site if needed. We contain the attack, investigate how they got in and what they took, and help you restore operations from clean backups.
We also handle the non-technical side: coordination with your insurer and lawyers, notifications to the national CSIRT and data protection authority, and messaging to customers and staff.
Real scenarios
Incidents we typically handle.
Double-extortion ransomware
Encrypted servers and a threat to leak data. Containment, initial access identification, phased recovery and support on the payment decision.
CEO fraud
A transfer ordered from a compromised mailbox. We trace the access, lock the account and provide the report for the bank and the police.
Customer data leak
A database posted on a forum. We establish the source and exact scope and prepare the notification to the authority and affected people.
What you get
From crisis to normal, documented.
- Attacker containment and eradication
- Forensic report with a full timeline
- Draft notifications to authorities
- Recovery plan and backup verification
- Expert report valid for legal proceedings
- Lessons learned and improvement plan
How we engage
Be ready before you need it.
On demand
You call us when it happens.
- No fixed fee
- Activation subject to availability
- Emergency hourly rate
- Most chosen
Retainer
Prepaid hours and guaranteed priority.
- 1-hour SLA
- Unused hours go to exercises
- Response plan included
Retainer + MDR
Monitoring and response by the same team.
- Prior context on your network
- Immediate containment
- No extra cost per incident
Defence and response
What is included
- 01
Immediate containment
We isolate systems, cut attacker access and stop encryption.
- 02
Forensics
We establish how they got in, what they touched and what left, with chain of custody.
- 03
Recovery
We restore safely and make sure no back doors remain.
- 04
Notifications
We draft notices to regulators, data protection authorities and customers on time.
Incident response
How we work
- 1
Call
An operator assesses the situation and guides you within minutes.
- 2
Containment
We stop the spread without destroying evidence.
- 3
Eradication
We remove persistence and compromised credentials.
- 4
Lessons
Final report and a plan so it does not happen again.
FAQ
Frequently asked questions
Do you help companies that are not clients?
Yes. Call us even without a contract: we activate an emergency retainer on the spot.
Do you negotiate with attackers?
We advise you on every option and its legal impact. The decision is always yours.
Should I power off affected machines?
Preferably not. Disconnect them from the network but keep them on: memory holds key evidence that is lost on shutdown. Call us before doing anything else.
Do you work with my insurer?
Yes. We regularly work with the main cyber insurers and tailor reports to what they need for the claim.
Do you recommend paying the ransom?
We give you the information to decide: whether backups are recoverable, the legal risk and what that group usually does. The decision is yours, and in most cases it can be avoided.
You may also need
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.