Under attack? Breathe.
Then read this.
If you are under attack or you have just been breached, two things are working against you: the clock, and panic. We deal with both. Senior-led cyber incident response services means the person who picks up has been in this exact situation before, takes control, and works it with you until it is over.
Live attacks, ransomware, a breach you only just noticed. We have handled all three, including one that changed its tactics by the day.
Live attacks, ransomware, a breach you only just noticed. We have handled all three, including one that changed its tactics by the day.
What do I do in a cyber attack?
If it is happening right now, before you call anyone, do four things:
- Disconnect the affected machines from the network, so whatever is spreading stops spreading.
- Do not pay anyone, because a ransom rarely buys back what it promises and marks you as someone who pays.
- Do not start deleting, wiping or tidying up, because that is the evidence you will need for your insurer, the regulator, and working out how they got in.
- Then get a senior person on the phone. From there, we take it.
Proven Under Fire
Evidence Secured
Retainer or Emergency
Immediate Action
Whole-Estate Diagnosis
Senior-Led Execution
A cyber attack is not a fair fight.
An attacker chooses the moment. You find out afterwards, usually at the worst possible time, and often from someone outside your business who noticed before you did. By the time most companies grasp what is happening, the attacker has had hours, sometimes weeks, of a head start. That is the position you are negotiating from, and it is why speed and experience matter more here than anywhere else in security.
The instinct is to reach for a tool and hope. The awkward truth is that the tool was already running when this started, and it did not stop it. An active incident is not a settings problem. It is a fast, adaptive, human problem, and it needs a fast, adaptive, human answer.
The good news, if there is any to be had mid-crisis, is that most incidents are survivable when they are met early by someone who has done it before and does not flinch. The damage is usually done in the dithering, not the attack. We do not dither.
The instinct is to reach for a tool and hope. The awkward truth is that the tool was already running when this started, and it did not stop it. An active incident is not a settings problem. It is a fast, adaptive, human problem, and it needs a fast, adaptive, human answer.
The good news, if there is any to be had mid-crisis, is that most incidents are survivable when they are met early by someone who has done it before and does not flinch. The damage is usually done in the dithering, not the attack. We do not dither.
What is incident response?
Incident response is what you do when prevention has already failed and something is actively going wrong: a live attack, a breach, ransomware, a flood of malicious traffic trying to take you offline. It covers the whole arc, from the first frantic hour to the quiet weeks of repair afterwards. The job is to take control quickly, stop the harm, remove the cause, get you running again, and leave you harder to hit next time. It runs from edge and WAF mitigation against live traffic attacks through to post-breach repair and the report your insurer will ask for. Done well, it turns a potential catastrophe into an expensive but recoverable bad week.
When to call us.
Call when something is actively wrong, or when you only suspect it might be. A site buckling under traffic that is not your customers. Files suddenly encrypted, or a ransom note where your documents used to be. Logins from places nobody has been. A customer or a bank telling you your data has turned up somewhere it should not. Strange outbound traffic, accounts you did not create, a system behaving as though someone else is at the wheel. You do not need to be certain. Early and wrong costs a phone call. Late and right costs the business.
How fast can you respond?
Fast, and by a senior person rather than a queue. Your first contact is with someone who can actually act, not a form that raises a ticket for someone else to read tomorrow. How quickly we are hands-on depends on whether we have met before. A client on a retainer gets a guaranteed, priority response, because the groundwork is done and we already know your systems. A cold emergency call starts a little slower, only because the first hour goes on learning what a retainer would already have told us. Either way the aim is the same: contain first, explain later.
Retainer, or emergency call-out.
Two ways in. A retainer puts us on standby before anything happens: we learn your systems, agree how we mobilise, and you get priority response when it counts, for a known cost rather than a panicked one. An emergency call-out is exactly that. You ring mid-incident and we start cold, charged for the hours worked and the tools the situation demands. The retainer is cheaper per incident and faster every time. The call-out exists because not everyone reads this page before the bad day, and we would still rather pick up than not.
What cyber incident response services actually involve.
01. Take control
Work out what is actually happening, which systems are hit, and who is on the other end, while preserving the evidence you will need later. Calm command in the first hour decides how the rest goes.
Triage & scoping
Attacker identification
Evidence preservation
Incident command
02. Stop it
Cut the harm off at the source. For live traffic attacks that means mitigation at the edge and the WAF, adapting the rules as the attacker shifts. For an intrusion it means isolating systems and revoking the access they are riding in on.
Edge & WAF mitigation
Traffic filtering
System isolation
Live-threat monitoring
03. Remove and recover
Get the attacker, the malware and the hidden footholds out, close the door they came through, and bring clean systems back online while watching for a second attempt.
Malware & persistence removal
Entry-point closure
Clean restoration
Re-intrusion watch
04. Report and harden
Produce the evidence record your insurer and the regulator need, work out exactly who must be told, and put in the lasting fixes so the same door does not open twice.
Forensic record
Root-cause analysis
Post-incident hardening
ICO / insurer reporting
An engineered response, not a plugin.
When a business is under attack, the instinct, and the cheap provider’s entire offer, is to reach for a tool. Run a scanner. Install an agent. Let an automated playbook fire and hope. It works beautifully against attacks that hold still. A real incident does not hold still. A live attacker watches what you do, and the moment your defence runs a predictable script, they simply route around it. The serious ones we have handled evolved by the day, with more than one hand on the keyboard, changing tactics faster than any rule could be written for them. You do not answer that with a plugin. You answer it with someone who thinks faster than the attacker and rewrites the response while it is still happening. AI can flag the noise. It cannot out-manoeuvre a human who is actively trying to beat you. That is the whole job, and it is the one thing no tool ships with.
What you will not get here.
No ticket queue between you and a person while the clock runs. No junior reading from a playbook a real attacker has already read too. No bill padded with tools bought to look busy rather than to fix the problem. We will not tell you to pay a ransom, and we will not pretend a single product would have saved you.
When it is genuinely beyond one pair of senior hands, we say so and bring in the right specialist rather than bluff it. In a crisis, the honest answer is worth more than the confident one.
When it is genuinely beyond one pair of senior hands, we say so and bring in the right specialist rather than bluff it. In a crisis, the honest answer is worth more than the confident one.
Q&A: PCI DSS Basics
What Are Cyber Incident Response Services?
The work of handling an active cyber attack or breach: taking control, containing the damage, removing the attacker, getting you running again, and repairing what was hit. It spans live traffic and WAF mitigation through to post-breach repair and the report your insurer needs. We have done it under sustained, evolving attack, at corporate level.
What Should I Do Right Now if I’m Being Attacked?
Disconnect the affected machines from the network so it stops spreading. Don’t pay anyone. Don’t delete or wipe anything, you will need it as evidence. Then get a senior responder on the phone. The first hour is about containment and a clear head, not heroics.
Should I Pay the Ransom?
The guidance, ours and the NCSC’s, is no. Paying does not guarantee your data back, it funds the next attack, and it marks you as a payer for the next group along. There are usually better routes through clean backups and recovery, and decisions like this are exactly why you want experienced help before reaching for the card.
How Fast Can You Start?
A senior person, not a queue, takes your first call. Clients on a retainer get a guaranteed priority response because we already know their systems. A cold emergency call starts a little slower, only because the first hour goes on learning what a retainer would already have told us.
Do I Need to Report a Breach?
Often, yes. Where personal data is involved, UK GDPR generally requires you to notify the ICO within 72 hours of becoming aware. There may be others to tell too: customers, your bank, sometimes the police. Part of the job is working out exactly who must be told, and helping you tell them properly.
What’s the Difference Between a Retainer and an Emergency Call-Out?
A retainer is arranged before anything happens: we learn your systems, agree how we mobilise, and you get priority response at a known cost. A call-out is mid-crisis, started cold, charged for hours worked and tools used. The retainer is cheaper and faster every time. The call-out exists for everyone who did not arrange one.
Can’t I Just Rely on My Antivirus or Firewall?
They help, and they were almost certainly running when this started. Automated defences stop attacks that behave predictably. A live attacker watches your defences and adapts around them, which is the one thing a tool cannot do back. That gap, between a fixed rule and a thinking opponent, is the whole reason incident response exists.
AI will spot the alarm in milliseconds, but won’t out-think the human on the other end – humans are unpredictable.
Under attack? Don’t wait to read the rest.
If something is happening right now, stop reading and get in touch. The page will still be here afterwards. If you would rather never make that call cold, a retainer means a senior responder already knows your systems and is ready before the bad day arrives. Either way, the first conversation is quick, and it is with someone who has done this for real.