Challenges
Responding to a security incident
A stolen password or a device behaving strangely. The first hour decides how bad it gets: contain, recover, then close the gap.
The challenge
An invoice email looked right until it did not. A laptop is slow and files have odd names. A supplier says your account sent them something you never wrote. Whatever the first sign, the pattern is the same: isolate what is affected, secure the accounts, recover from clean backups, and find out how it got in.
What we would do first
-
Call us
A person answers within three rings. Tell us what you saw and when, and do not switch anything off until we say so.
-
Contain it
Infected devices isolated and cleaned, Microsoft 365 sign-ins checked for account takeover, passwords reset and multi-factor authentication enforced.
-
Recover
Files and systems restored from backup, with recovery times agreed around what matters most to you.
-
Prevent the next one
Email filtering, endpoint and identity protection, security awareness training and Cyber Essentials certification to close the gap it came through.
The services that apply
-
Endpoint and identity protection
Every computer, laptop and server protected against malware and ransomware, with threats watched for and dealt with by our team.
-
Backup and recovery
Every copy of your data backed up and recoverable, wherever it lives, with recovery times agreed around what matters most to you.
-
Email filtering and cloud protection
Spam, phishing and malware stopped before they reach an inbox, so your people are not the last line of defence.
-
Security awareness training
Short, regular training and realistic phishing simulations, so your people recognise an attack and report it instead of clicking.
-
Cyber Essentials consultancy
Help getting your business through Cyber Essentials, from finding the gaps to putting the controls in place and preparing the evidence.
Further reading
-
Guide
Why smart people still click: the business case for security awareness training
At 16:42 on a Friday, smart loses to tired. Why awareness training matters, and what you get for your money.
Read the guide →
Questions people ask
We are not an Odyssey client. Can you still help?
Yes. Call us and tell us what has happened. We will tell you what to do first, and whether we can take it on.
What should we tell you when we call?
What you saw and when it happened. A person answers within three rings, and we tell you what to do first.
What if someone's Microsoft 365 account has been taken over?
We check Microsoft 365 sign-ins for account takeover, reset passwords and enforce multi-factor authentication, and isolate and clean any infected devices.
Can you restore our files after an attack?
Where backups exist, yes. Files and systems are restored from backup, with recovery times agreed around what matters most to you.
How do we stop it happening again?
By closing the gap it came through, with email filtering, endpoint and identity protection, security awareness training or Cyber Essentials certification, depending on how it got in.
Talk to a human about a security incident
Call and we answer within three rings. Or tell us what you need and we will call you back at any time.