Under attack? Breathe.
Then read this.
If you are under attack or you have just been breached, two things are working against you: the clock, and panic. We deal with both. Senior-led cyber incident response for ransomware, intrusions, malicious traffic and compromised systems, from urgent containment through to clean recovery and repair.
Live attacks, ransomware, data breaches and sustained malicious traffic. We have handled incidents across that spectrum, including one that changed tactics by the day.
Live attacks, ransomware, data breaches and sustained malicious traffic. We have handled incidents across that spectrum, including one that changed tactics by the day.
What do I do in a cyber attack?
If it is happening right now, before you call anyone, do four things:
- Disconnect affected devices from wired, Wi-Fi and mobile network connections. Do not switch them off unless advised, and do not wipe or alter anything
- Do not pay or contact the attacker before taking specialist and legal advice. Payment does not guarantee recovery and can make the situation worse.
- Do not start deleting, wiping or tidying up, because that is the evidence you will need for your insurer, the regulator, and working out how they got in.
- Then get a senior person on the phone. From there, we take it.
Proven Under Fire
Evidence Secured
Retainer or Emergency
Immediate Action
Whole-System Diagnosis
Senior-Led Execution
When our website came under a sustained and constantly evolving attack, Erryn stepped in and took complete ownership of the situation.
www.discount-trade-supplies.com
He worked continuously to keep the site available and the business trading, adapting the protection as the attack changed. Once the immediate threat was under control, he migrated the entire platform to a significantly more secure and resilient infrastructure within days, without disrupting our customers.
What impressed us most was that he did not simply apply a temporary fix and walk away. He identified how the site was being targeted, removed the underlying exposure and rebuilt the technical foundations properly. We went from an extremely serious and disruptive situation to having confidence in the website again.
A cyber attack is not a fair fight.
An attacker chooses the moment. You find out afterwards, usually at the worst possible time, and often from someone outside your business who noticed before you did. By the time most companies grasp what is happening, the attacker has had hours, sometimes weeks, of a head start. That is the position you are negotiating from, and it is why speed and experience matter more here than anywhere else in security.
The instinct is to reach for a tool and hope. The awkward truth is that the tool was already running when this started, and it did not stop it. An active incident is not a settings problem. It is a fast, adaptive, human problem, and it needs a fast, adaptive, human answer.
The good news, if there is any to be had mid-crisis, is that most incidents are survivable when they are met early by someone who has done it before and does not flinch. The damage often compounds during the delay between discovery and decisive containment. We do not add to that delay.
The instinct is to reach for a tool and hope. The awkward truth is that the tool was already running when this started, and it did not stop it. An active incident is not a settings problem. It is a fast, adaptive, human problem, and it needs a fast, adaptive, human answer.
The good news, if there is any to be had mid-crisis, is that most incidents are survivable when they are met early by someone who has done it before and does not flinch. The damage often compounds during the delay between discovery and decisive containment. We do not add to that delay.
What is incident response?
Incident response is what you do when prevention has already failed and something is actively going wrong: a live attack, a breach, ransomware, a flood of malicious traffic trying to take you offline. It covers the whole arc, from the first frantic hour to the quiet weeks of repair afterwards. The job is to take control quickly, stop the harm, remove the cause, get you running again, and leave you harder to hit next time. It runs from edge and WAF mitigation against live traffic attacks through to post-breach repair and the report your insurer will ask for. Done well, it turns a potential catastrophe into an expensive but recoverable bad week.
When to call us.
Call when something is actively wrong, or when you only suspect it might be. A site buckling under traffic that is not your customers. Files suddenly encrypted, or a ransom note where your documents used to be. Logins from places nobody has been. A customer or a bank telling you your data has turned up somewhere it should not. Strange outbound traffic, accounts you did not create, a system behaving as though someone else is at the wheel. You do not need to be certain. Early and wrong costs a phone call. Late and right costs the business.
How fast can you respond?
Fast, and by a senior person rather than a queue. Your first contact is with someone who can actually act, not a form that raises a ticket for someone else to read tomorrow. How quickly we are hands-on depends on whether we have met before. Retainer clients receive priority response under an agreed service level because the groundwork is already complete and we know the environment. A cold emergency call starts a little slower, only because the first hour goes on learning what a retainer would already have told us. Either way the aim is the same: contain first, explain later.
Retainer, or emergency call-out.
Two ways in. A retainer puts us on standby before anything happens: we learn your systems, agree how we mobilise, and you get priority response when it counts, for a known cost rather than a panicked one. An emergency call-out is exactly that. You ring mid-incident and we start cold, charged for the hours worked and the tools the situation demands. The retainer is cheaper per incident and faster every time. The call-out exists because not everyone reads this page before the bad day, and we would still rather pick up than not.
What cyber incident response services actually involve.
01. Take control
Work out what is actually happening, which systems are hit, and who is on the other end, while preserving the evidence you will need later. Calm command in the first hour decides how the rest goes.
Triage & scoping
Threat and intrusion analysis
Evidence preservation
Incident command
02. Stop it
Cut the harm off at the source. For live traffic attacks that means mitigation at the edge and the WAF, adapting the rules as the attacker shifts. For an intrusion it means isolating systems and revoking the access they are riding in on.
Edge & WAF mitigation
Traffic filtering
System isolation
Live-threat monitoring
03. Remove and recover
Get the attacker, the malware and the hidden footholds out, close the door they came through, and bring clean systems back online while watching for a second attempt.
Malware & persistence removal
Entry-point closure
Clean restoration
Re-intrusion watch
04. Report and harden
Produce the evidence record your insurer and the regulator need, work out exactly who must be told, and put in the lasting fixes so the same door does not open twice.
Incident evidence record
Root-cause analysis
Post-incident hardening
ICO and insurer reporting support
An engineered response, not a plugin.
When a business is under attack, the instinct, and the cheap provider's entire offer, is to reach for a tool. Run a scanner. Install an agent. Let an automated playbook fire and hope. It works beautifully against attacks that hold still. A real incident does not hold still. A live attacker watches what you do, and the moment your defence runs a predictable script, they simply route around it. The serious ones we have handled evolved by the day, with more than one hand on the keyboard, changing tactics faster than any rule could be written for them. You do not answer that with a plugin. You answer it with someone who thinks faster than the attacker and rewrites the response while it is still happening.
Automation is excellent at detecting known patterns and taking predefined actions. It is less useful when an attacker changes tactics, the evidence conflicts or containment risks taking the business down with the threat. That is where experienced human judgement matters.
Automation is excellent at detecting known patterns and taking predefined actions. It is less useful when an attacker changes tactics, the evidence conflicts or containment risks taking the business down with the threat. That is where experienced human judgement matters.
What you will not get here.
No ticket queue between you and a person while the clock runs. No junior reading from a playbook a real attacker has already read too. No bill padded with tools bought to look busy rather than to fix the problem. We do not recommend paying a ransom. Any extortion decision must involve your insurer, legal advisers and the appropriate authorities, with a clear understanding that payment offers no guarantee of recovery.
When it is genuinely beyond one pair of senior hands, we say so and bring in the right specialist rather than bluff it. In a crisis, the honest answer is worth more than the confident one.
When it is genuinely beyond one pair of senior hands, we say so and bring in the right specialist rather than bluff it. In a crisis, the honest answer is worth more than the confident one.
Cyber incident response questions
What Are Cyber Incident Response Services?
The work of handling an active cyber attack or breach: taking control, containing the damage, removing the attacker, getting you running again, and repairing what was hit. It spans live traffic and WAF mitigation through to post-breach repair and the report your insurer needs. We have done it under sustained, evolving attack, at corporate level.
What Should I Do Right Now if I'm Being Attacked?
Disconnect the affected machines from the network so it stops spreading. Don't pay anyone. Don't delete or wipe anything, you will need it as evidence. Then get a senior responder on the phone. The first hour is about containment and a clear head, not heroics.
Should I Pay the Ransom?
The guidance, ours and the NCSC's, is no. Paying does not guarantee your data back, it funds the next attack, and it marks you as a payer for the next group along. There are usually better routes through clean backups and recovery, and decisions like this are exactly why you want experienced help before reaching for the card.
How Fast Can You Start?
A senior person, not a queue, takes your first call. Clients on a retainer get a guaranteed priority response because we already know their systems. A cold emergency call starts a little slower, only because the first hour goes on learning what a retainer would already have told us.
Do I Need to Report a Breach?
Often, yes. Where a personal data breach is likely to risk people’s rights and freedoms, it must normally be reported to the ICO without undue delay and within 72 hours of becoming aware of it. We help establish the facts and work alongside your legal or data-protection adviser on the notification.
What's the Difference Between a Retainer and an Emergency Call-Out?
A retainer is arranged before anything happens: we learn your systems, agree how we mobilise, and you get priority response at a known cost. A call-out is mid-crisis, started cold, charged for hours worked and tools used. The retainer is cheaper and faster every time. The call-out exists for everyone who did not arrange one.
Can't I Just Rely on My Antivirus or Firewall?
They help, and they were almost certainly running when this started. Automated defences stop attacks that behave predictably. A live attacker watches your defences and adapts around them, which is the one thing a tool cannot do back. That gap, between a fixed rule and a thinking opponent, is the whole reason incident response exists.
Under attack? Don't wait to read the rest.
If something is happening right now, stop reading and get in touch. The page will still be here afterwards. If you would rather never make that call cold, a retainer means a senior responder already knows your systems and is ready before the bad day arrives. Either way, the first conversation is quick, and it is with someone who has done this for real.