If it’s happening right now: don’t switch everything off or wipe anything yet. Disconnect affected machines from the network where you can, change passwords from a device you trust, write down what you’ve noticed and when, and call me. Evidence lost in the first hour is hard to get back.
Some events are truly unexpected. A server starts behaving strangely, files are suddenly encrypted, a mailbox sends messages nobody wrote, or your IT provider tells you something “doesn’t look right”. If you suspect a security incident, I can help you understand what has happened, limit the damage and get back on your feet. I’ve worked through many complex incidents over more than 20 years in IT.
Independent assessment
I’ll review what you’ve seen so far, the logs and systems involved, and give you a clear, plain-language view of what is likely to have happened, how serious it is, and what to do next. I’m happy to sign an NDA before we start.
Containment and recovery
I’ll work with you, your staff and any IT provider to contain the incident, decide what needs to be rebuilt or restored, and plan a safe return to normal operation. Files encrypted by ransomware usually can’t be decrypted without the attackers’ key, so I don’t promise decryption. Instead, I’ll help you find and restore what survived: backups, cloud copies and systems the attack didn’t reach. Where data has been damaged or lost in other ways, I can also help with data and storage recovery.
Working with others
Incidents often involve several parties: your IT provider, software vendors, your insurer and sometimes regulators. I can act as your independent technical voice, explaining the situation to each of them and making sure nothing falls between the cracks.
After the incident
Once things are stable, I’ll review how the incident happened and recommend the most important improvements, from account security and backups to monitoring and staff awareness, so the same thing is much less likely to happen again.
I’m not a 24/7 security operations centre, but I respond quickly and work with you through the incident. Every engagement starts with a short call to understand the situation.