Incident response
When something goes wrong, we move fast.
A ransom note, a hacked mailbox or a suspicious payment request needs expert help now, not tomorrow. We contain the threat, find out what happened and what was affected, restore your systems and guide you through your reporting obligations, with a 30-minute initial response to critical incidents.
What's included
Incident Response
-
Rapid containment
Compromised accounts disabled and affected devices isolated to stop the attack spreading.
-
Investigation
Logs and forensic evidence used to establish how the attacker got in, what they touched and whether data was taken.
-
Recovery
Systems cleaned and restored from trusted backups, and access rebuilt securely.
-
Reporting obligations
Help assessing notifiable data breaches under the Privacy Act and reporting to ASD's ACSC, including ransomware payment reports where they apply.
-
Clear communication
A single point of contact, with hourly updates during critical incidents.
-
Post-incident review
A root-cause report with the changes that stop it happening again.
- 30min
- Initial response to critical incidents
- 1hr
- Initial response to high-severity threats
- 4hrs
- Initial response to suspicious activity and phishing
The outcome
What changes for you.
- Attacks contained quickly
- Clear answers on what happened
- Reporting deadlines met
- Stronger defences afterwards
FAQ
Common questions.
Something else on your mind? Call us and talk to an engineer, not a salesperson.
02 8883 3377What should we do first if we think we've been hacked?
Call us straight away. Don't switch devices off or delete anything, as that can destroy evidence. If you can, disconnect affected devices from the network, and don't pay a ransom before getting advice.
Do we have to report a cyber incident?
It depends. If personal information is involved and serious harm is likely, the Notifiable Data Breaches scheme requires you to notify the OAIC and the people affected. Businesses with annual turnover over $3 million must also report any ransomware payment to ASD within 72 hours. We'll help you work out what applies.
Should we have an incident response plan?
Yes. A tested plan means everyone knows who to call, who makes decisions and how to communicate when it matters. We write and test plans as part of our Compliance plan, or as a standalone project.
Related services
Works best together.
- Cloud & Microsoft 365 Backup Independent, immutable backups of Microsoft 365, servers and devices, checked daily and restore-tested. Learn more
- Endpoint Protection & EDR Microsoft Defender-based detection and response on every device, monitored 24/7. Learn more
- Business Continuity & DR Recovery plans, tested backups and clear recovery targets, so a bad day doesn't become a disaster. Learn more
Incident support
Think you've been breached?
Call us now. The sooner we start containing an incident, the less damage it does. Existing clients can also log an urgent ticket through the client support portal.