Ransomware and compromised systems
We assess propagation and affected assets. We coordinate isolation, investigation and the recovery options available.
Cybersecurity · Incident response
Incident response: regain control. Protect your company’s continuity.
When you detect suspicious access, ransomware or a possible information leak, you need to understand what is happening and decide how to act.
We support you through containment, investigation and recovery, coordinating with your technical team, management and suppliers. We prioritise actions according to the risk to your data and the impact on your activity.
When we step in
A response tailored to the incident and your environment.
Compromised Microsoft 365 accounts and environments
We review sign-ins, active sessions, application permissions and suspicious changes. We investigate persistence mechanisms such as mail forwarding rules or credentials added to applications.
Unauthorised access on servers and cloud
We analyse logs, administrative activity and configuration changes to determine which resources may be compromised and which accesses must be revoked.
Possible theft or exposure of information
We look for evidence of access and data transfer. We separate confirmed facts from hypotheses and from the limitations of the investigation.
Email fraud and impersonation
We investigate affected accounts, messages and mail settings. We coordinate technical measures with internal stakeholders to reduce the risk of further fraudulent actions.
How we act
A coordinated intervention, with clear priorities.
1. Assessment and coordination
We gather the available information, assess severity and agree responsibilities, authorisations and a secure communication channel.
2. Containment
We limit exposure by isolating devices, blocking access or revoking sessions, depending on the case. We weigh every measure to balance protection, continuity and preservation of evidence.
3. Investigation
We correlate the available endpoint, identity, network and cloud logs. We reconstruct the sequence of the incident and look for indicators of compromise and persistence mechanisms.
4. Eradication and recovery
We fix the access paths identified and coordinate the removal of malicious components or the rebuild of systems where necessary. Restoration is carried out by priority and after checking security conditions.
5. Follow-up and improvement
We strengthen monitoring of the affected assets and document the pending measures, their owners and the order of implementation.
What you receive
Information to decide and a trace of what was done.
- Situation updates with risks and pending decisions.
- Timeline of the incident and list of affected assets.
- Record of evidence and actions, according to the contracted scope.
- Technical report and executive summary.
- Improvement plan to reduce exposure and strengthen recovery.
We coordinate technical information with your legal advisers, data protection officer and insurer where appropriate. The analysis helps assess the applicable obligations; legal decisions rest with the competent officers.
Analysts, technology and context
We use the information from your security tools and, where integration exists, from the SOC to speed up the investigation. Automation and AI support correlation and analysis; decisions with operational impact require the appropriate judgement and authorisations.
Common questions
Questions about Incident response
Can you step in if we already have an IT provider?
Yes. We coordinate the response with the people who know your infrastructure, keeping responsibilities and channels of action clear.
When is the service activated?
Availability, activation channels and response times are set in the contracted agreement. When you contact us, we confirm the intervention conditions.
Can all the information be recovered?
It depends on the extent of the damage, the state of the backups and the technical options available. We assess the alternatives before committing to an outcome.
Can we prepare before an incident happens?
We can define responsibilities, contacts, scenarios and response procedures, and check through exercises whether the plan works.
You may also be interested in
Related services
Managed SOC
Continuous threat monitoring, alert analysis and escalation of security incidents.
Learn moreBackup and disaster recovery
Backups ransomware cannot encrypt or delete, Microsoft 365 included, and real restore tests to get you running again when everything fails.
Learn morePentesting
Controlled intrusion tests across networks, web applications, APIs and identities, with a prioritised report and a remediation plan.
Learn moreDo you need to act, or to prepare your company?
If the incident is ongoing, contact the response team. If you want to get ahead, we review with you how to detect, contain and recover in a real situation.