Our response process
When you call us with a suspected ransomware or intrusion, we follow a proven protocol:
- Contain: we isolate affected systems immediately to stop the attack spreading across your network.
- Investigate: our forensics team identifies how the attacker got in, what they touched and what was stolen or encrypted.
- Eradicate: we remove the malware and the attacker's access paths so they cannot simply come back.
- Recover: we restore systems and data from clean, verified backups - never from attacker-controlled sources.
- Report and harden: you receive a clear incident report, and we fix the gaps so the same attack cannot succeed again.
How long does it take?
Every incident is different. Containment typically starts within minutes of your call. Full recovery time depends on what was affected and the state of your backups - which is why we test restores continuously on our managed backup service.
Will we lose data?
With clean, recent, tested backups, most clients recover with little or no permanent data loss. The single most important factor is calling us early - before the attacker encrypts more of your estate.
