Defend
Incident response
Phishing gets through at well-run firms too. What counts is what happens next, and with us it’s always the same sequence: contain, check, clean up, tell you first, write it down.
Every incident runs the same sequence.
A convincing email gets through at well-run firms too, and a ransom note doesn’t ask whether the week is busy. What counts is what happens next: whether the first hour goes into containing it or into wondering whom to call, whether the evidence is kept or wiped, and whether the decisions that are yours, what to report, whom to tell, whether to pay, are made on facts or under pressure. So with us every incident runs the same sequence, led by your TechPilot with our security specialists, and ends in the record. You make the decisions. We supply the facts and the timelines.
The sequence
Six steps, in this order, every time.
Within our service hours an incident goes straight to the engineers who know your setup, with your TechPilot in charge. Outside them, as agreed in your contract, at a cost agreed in advance. Either way, the sequence is the same.
-
You tell us
Straight away, through the one way in your people already know. The sooner we know, the less there is to clean up, and the evidence is still there. Nobody is ever blamed for calling too early.
-
We contain it
Whatever stops it spreading comes first: the account locked and its sessions revoked, the device taken off the network, the server isolated. Containment doesn’t wait for the full picture.
-
We check what happened
The evidence is secured before anything is cleaned: sign-ins, mail flow, logs. Then we work out how they got in, what was accessed, what was sent or taken, and whether anything else was reached.
-
We clean up
Whatever the attacker changed or left behind comes out: inbox rules, forwardings, sessions, accounts, software. Then the other ways in are checked and ruled out, so the door they used isn’t still open.
-
We tell you first
In plain words, with the facts and the timeline: what was reached, when, which data, which people. Who has to hear it from you, clients, your insurer, the authority, is your decision; the legal assessment stays with you. We prepare what your data protection officer needs, then help you tell them.
-
We write it down
What happened, what we did and what we changed, straight into your evidence file: a short technical report, a version for your firm and a summary for your leadership. Then we change what let it happen, so it doesn’t come back.
By platform
Two scenarios, one sequence.
Phishing and ransomware are the two incidents this page is written for. Each has its own page: what is different about it, and what stays the same.
On record
In your evidence file.
- What happened, in order, with times: the record your insurer and your data protection officer need
- What we did, step by step, and when
- What you decided: what was reported to whom, and when, kept with the record
- What we changed afterwards, so it doesn’t happen the same way again
Written as it happens, not reconstructed a week later. That’s what makes it stand up when someone asks.
What usually goes wrong without it.
-
Nobody knows whom to call
The person who clicked tells nobody for a day, hoping it goes away. By the time IT hears, the mass mailing has gone out and the attacker has set up a second way in.
-
The evidence is wiped first
The laptop is reinstalled and the mailbox tidied before anyone looked at what was accessed. Now nobody can say what left the firm, and the question of whether to report it can’t be answered.
-
Decisions made in the night
Whether to pay, whom to tell and what to report get decided under pressure, without the facts, by whoever is still awake. The record afterwards is a memory.
Also under Defend
- Email security Spam, phishing and malware filtered out before a mail reaches anyone, with long-term archiving.
- Multi-factor sign-in A second factor for every account, so a stolen password on its own opens nothing.
- Conditional access Who is signing in, from where and on which device, checked every time.
- Device protection Managed protection and threat detection on every laptop, workstation and server, to a documented baseline.
- Patching and vulnerability management Updates rolled out from one place, and the gaps that remain found and closed.
- Admin access Admin rights for few, by name; passwords in a vault; every use logged. Our own keys first.
- Backups and restore tests Backed up, restored on purpose before you need it, dated, and kept for the years you’re bound.
- Security monitoring Devices, sign-ins and systems watched centrally; what the monitoring found, reviewed by our engineers, and what we changed.
- Access reviews Who can open what, reviewed with you, so access that made sense last year doesn’t quietly stay.
- The evidence file What protects your firm, written down as it is, ready on the day an insurer, a client or an auditor asks.
- Insurer and client questionnaires Your insurer’s and your clients’ security questionnaires, answered with what’s true today, the gaps closed before renewal.
- Changing provider The old provider’s software and access removed, with a written check that nobody keeps a way in.
Questions we get
What should our people do the moment they suspect something?
Tell us straight away and leave everything as it is: don’t reinstall the laptop, don’t delete the mail, don’t tidy the mailbox. The sooner we know, the less there is to clean up, and the evidence is still there for the questions that come later.
Who decides whether to report it, and whom to tell?
You do. We supply the facts: what was reached, when, which data, which people, and the timeline. The legal assessment stays with you, your data protection officer or your lawyer. Then we help you tell the people who have to hear it from you, in words that are accurate.
What if it happens outside your service hours?
Within our service hours an incident goes straight to the engineers who know your setup, with your TechPilot in charge. Outside them, what applies is written in your contract, at a cost agreed in advance, so on the day nobody has to look it up.
Does this cover what our cyber insurer requires?
Most policies ask for a written incident plan and for the insurer to be told within the period the policy sets. The record we keep is written as things happen, so your insurer’s questions get facts with times. Whom to tell and when stays your decision, under your policy’s terms.
Is this what you did for a real client?
Yes. The sequence comes from a phishing attack that reached seven accounts and sent 2,500 mails: two of our engineers worked in parallel from the first day, every session was revoked, the other ways in were ruled out, and the data protection officer got the facts for the decision whether to report it. It became our standard response for every client.
Start
Who would your people call first?
In a first call we go through what happens at your firm today when someone clicks, who decides what, and where the way back is.
- No first level
- No surprises
- Pilot before you buy