Cyber and physical security
Cyber incident response
When something goes wrong, such as a hacked mailbox, ransomware or a suspicious login, we help you contain it, recover and work out what happened, 24×7.
What we do
Contain
Lock compromised accounts, revoke sign-ins, isolate affected devices and stop it spreading.
Investigate
Use sign-in logs, mailbox audit logs and device data to find out how they got in and what they touched.
Recover
Restore from clean backups, reset what needs resetting, and close the way in.
Report and learn
Help you decide what needs reporting and to whom, and fix what let it happen.
Reporting a breach
If personal data is involved, UK GDPR may require you to report the breach to the Information Commissioner's Office within 72 hours of becoming aware of it. Keeping a clear record from the first minute makes that much easier.
Before anything happens
Backups that survive an attack
At least one copy that ransomware can't reach or delete.
Logs kept long enough
Microsoft 365's default audit retention is short on some plans. Longer retention means you can see what happened.
A plan on paper
Who to call, who decides, and how to work if email is down.
Technologies
Questions
We're not a customer. Can you still help?
Yes. Call or email us and we'll help you contain it first, then sort out the rest.
More cyber and physical security
Tell us what you need.
Email us about your IT: what you have now, what isn't working, and what you'd like to change.