Business
The first hour is for containing. Everything else can wait sixty minutes.
Most damage in an incident happens after discovery, through panic, wiping evidence, paying too early or telling nobody. We take over the first hours with a plan, stop the spread, find how they got in, and run the reporting to CERT-In, the regulator, the Data Protection Board and your insurer in the order the clock demands. The evidence we collect is handled so it is usable with the police and in court.
- Response within agreed hours for retainer clients; best effort same day for everyone else
- Containment, eradication and recovery plan led by one responder you can reach
- Forensic investigation with chain of custody, written for management, police and insurers
- CERT-In six-hour reporting, DPDP breach notification and regulator reporting handled
Emergency response billed by the day with a written estimate in the first hours; annual retainer available with guaranteed response times and a lower day rate.
Typical engagement
- Call
- Contain
- Investigate and recover
- Report and harden
Who this is for
- Companies with systems encrypted or a ransom note on the screen
- Finance teams that have paid an invoice to a changed bank account or found a mailbox rule forwarding emails
- Organisations told by a customer, a researcher or the press that their data is online
- Employers who suspect a departing employee has taken customer data or source code
- Hospitals, schools and institutions with outsourced IT and no responder on call
- Companies that want a retainer so the first call during an incident is not a cold one
What is included
Emergency triage
A call within the hour to establish what is affected, what to isolate, what not to touch, and who needs to be told now. A written containment plan follows the same day.
Containment and eradication
Isolation of affected systems, credential resets in the right order, removal of attacker access and persistence, and verified clean recovery from backups where available.
Forensic investigation
Collection of logs, disk and memory images and cloud audit trails with chain of custody; a timeline of the intrusion, the initial access, what was accessed or taken, and the evidence for each conclusion.
Business email compromise
Mailbox audit for rules, delegations and OAuth grants, identification of the compromised account and the fraudulent transactions, bank recall and 1930 complaint support, and hardening against repeat.
Reporting and notification
CERT-In reporting within six hours, Data Protection Board and data principal notifications under the DPDP rules, RBI or SEBI reporting where regulated, insurer notification and the police complaint, with drafts prepared by us.
Post-incident report
A plain-language account of what happened, how, what was affected, what was done and what must change, suitable for the board, the insurer, the regulator and the police.
How we work
Call
One number. We start with what is still running, what has been touched and who knows. Stop-doing instructions come first.
Contain
Agreed isolation steps executed by your IT with our direction, evidence preserved before anything is rebuilt.
Investigate and recover
Forensics in parallel with recovery so the rebuild does not reintroduce the attacker. Daily written update to management.
Report and harden
Final report, notifications completed, and a prioritised list of changes with a re-check date.
What you walk away with
- The spread stopped and the attacker's access removed, with verification
- A clear account of how it happened and what was taken, with evidence that can be used
- Notifications made on time and documented
- A short list of changes that would have prevented it
What we do not do
We would rather lose an enquiry than mislead you.
- We do not negotiate with or pay ransomware groups; we will explain the implications and work with specialist negotiators if you decide to engage one
- We cannot promise that encrypted data without backups will be recovered
- We do not replace your IT team for the rebuild; we direct and verify
Frequently asked questions
Should we pay the ransom?
Paying is a business decision with legal, ethical and practical risks: payment does not guarantee working decryptors, may fund further attacks and may need to be disclosed to regulators and insurers. Our first work is to find out whether backups or decryptors exist and what was actually taken, so the decision is made with facts rather than fear.
We have cyber insurance. Does that change the process?
Yes. Most policies require prompt notification and may require use of panel responders. We ask about the policy in the first call, help you notify correctly and coordinate with the insurer's panel so that coverage is not jeopardised by the response itself.
Our accounts team paid a fake invoice two days ago. Is it an incident?
Yes, and a time-critical one. The bank recall request and the 1930 complaint go in immediately, while we establish whether your mailbox or the supplier's was compromised; the answer determines who else is exposed. Mailbox rules and OAuth grants the attacker left are removed in the same session.
What should we not do before you arrive?
Do not wipe or rebuild affected machines, do not log in to compromised accounts repeatedly, do not reply to the attacker, and do not announce the incident widely until the containment plan exists. Do disconnect affected machines from the network and preserve any ransom notes and emails.
What does the retainer include?
Guaranteed response time, a lower day rate, an onboarding review so we know your environment before anything happens, a tabletop exercise a year, and the incident plan and contact tree kept current. Unused retainer hours can be applied to readiness work.
If it is happening now, call
Otherwise tell us what you have seen, when, how many systems or accounts, and whether anyone has been told. For a retainer, tell us your size and sector and we send terms within two working days.