Incident Response
Contain the damage and find out what happened
Incident Response
When a website is hacked, data leaks or ransomware locks your files, acting quickly limits the damage. We help you contain the incident, keep the evidence intact, find out how the attacker got in and what they touched, and bring systems back safely. Afterwards you get a written report of what happened and what to change, so you can close the gap the attacker used.
What We Deliver
What's included in Incident Response.
Containment
Isolating affected systems, resetting compromised accounts and removing the access the attacker used.
Investigation
Reviewing logs, servers and accounts to establish how the attacker got in and what they accessed.
Evidence preservation
Copying logs and affected systems before cleanup, so the facts are available for insurers, clients or authorities.
Clean recovery
Restoring from clean backups or rebuilt systems, and checking that nothing the attacker left behind remains.
Log monitoring
Central logging and alerts with a SIEM tool that suits your size and budget, so the next suspicious event is noticed early.
Incident report
A timeline, root cause and list of fixes, written for both your technical team and management.
Our Process
How the work runs, step by step.
Triage
We assess what is affected, how serious it is and what needs to be contained first.
Containment
We stop the incident from spreading while keeping the evidence the investigation needs.
Investigation
We trace how the attacker got in, what they did and which data may be affected.
Recovery
We restore systems and accounts, closing the gap that was used before bringing them back online.
Review and prevention
We deliver the report and help put monitoring and fixes in place to make a repeat less likely.
Frequently Asked Questions
Common questions about Incident Response.
Do not delete files or wipe servers yet, because that destroys the evidence of how the attacker got in. Change the passwords for your hosting, admin and email accounts from a clean device, and call or email us so we can help contain it properly.
It depends on what was affected. In India, CERT-In requires certain cybersecurity incidents to be reported, personal data breaches may have to be reported under data protection law, and your client contracts may require notice too. We help you gather the facts, and your legal advisor can confirm your obligations.
It depends on your backups and the type of attack, so we cannot promise recovery. We check every available source, starting with backups, before recommending next steps.
Keep tested backups, turn on logging, use two-factor authentication for admin accounts and write down who to call. We can help you put an incident response plan in place in advance.
Other Cybersecurity services
- Security Audit A structured review of your web applications, servers and code, with a written report that ranks each finding by risk.
- Penetration Testing Simulated cyber attacks to identify exploitable vulnerabilities before attackers do.
- Compliance & GDPR Gap assessments, policies and evidence to prepare your business for GDPR, India's DPDP Act, and ISO 27001, SOC 2 or PCI DSS audits.
- Secure Code Review Static and dynamic analysis of source code to detect security flaws.
Dealing with a security incident?
Call or email us with what you have noticed so far, and we will help you decide the first steps to contain it. Our office hours are on the contact page; if you need cover outside them, we agree it with you as part of the engagement.