Incident Response & Recovery

Response plan, roles, contact tree, playbooks, logging and backups in place — and rehearsed in tabletop exercises.

Confirm the incident, classify severity, identify affected systems, users and data, and preserve evidence.

Stop the spread: isolate endpoints, disable compromised accounts, block malicious traffic and segment the network — keeping the business running where it is safe.

Forensic analysis of endpoints, logs, email and cloud to establish how the attacker got in, what they touched and whether data left the organisation.

Remove malware and persistence, close the entry point, reset credentials, restore clean systems from backup and monitor closely for re-entry.

A clear report for management, insurers and regulators; root-cause fixes; updated controls, playbooks and training.