Active incident response

Dealing with a cyberattack right now?

Take a breath. The next few hours matter, and the right first moves make recovery faster and cheaper. Contact our team now, then work through the steps below.

Email incident@swiftsecuresolutions.comUse the priority form

Put URGENT in the subject and include a callback number. If email may be compromised, send from a separate account.

First response checklist

Six things to do in the first hour

  1. 1

    Isolate, don’t power off

    Disconnect affected machines from the network (unplug cables, disable Wi-Fi) but leave them running. Shutting down can destroy memory evidence investigators need.

  2. 2

    Switch to a safe channel

    Assume email and chat may be compromised. Coordinate by phone or personal devices, and don’t tip off the attacker in systems they may be watching.

  3. 3

    Preserve evidence

    Don’t wipe, reimage, or restore anything yet. Keep logs, ransom notes, suspicious emails, and screenshots. Write down what happened and when.

  4. 4

    Call your cyber insurer

    Many policies require prompt notice and pre-approved vendors. Calling early protects your coverage. Involve legal counsel, too.

  5. 5

    Stop the money

    If a payment was diverted, contact your bank immediately to request a recall, and file a report at ic3.gov. Speed matters for recovering funds.

  6. 6

    Bring in incident responders

    Contact us or your retained incident response firm. We’ll scope the incident, contain the attacker, and plan recovery with you.

Avoid these common mistakes

  • Paying a ransom or contacting attackers before talking with counsel, your insurer, and responders
  • Wiping or rebuilding systems before evidence is collected
  • Announcing the incident publicly before facts and obligations are clear
  • Resetting passwords from a device that may be compromised
What we do

How we help during an incident

  • Rapid scoping of what’s affected and how the attacker got in
  • Containment and removal of attacker access
  • Forensic evidence collection with chain of custody
  • Recovery planning and restoration support
  • Coordination with your insurer, counsel, and law enforcement
  • A clear report and hardening plan so it doesn’t happen again
Incident response services & retainers

Not in an incident?

Good. This is the best time to prepare. An incident response retainer and a tested recovery plan turn a crisis into a process.

Get ransomware-ready
FAQ

During an incident

Don’t see your question? Ask our security team directly.

How quickly can you respond?

We prioritize active incidents over all other work. Contact us right away, including whether the incident is ongoing, and we’ll respond as quickly as possible to begin scoping and containment. Clients on an incident response retainer receive guaranteed response times.

Can you help if we’re not an existing client?

Yes. We help organizations in active incidents whether or not we’ve worked together before. Having a retainer in place simply lets us start faster.

Should we contact law enforcement?

Reporting to the FBI through IC3 or a local field office is generally encouraged, especially for ransomware and wire fraud, and can help with fund recovery. Discuss timing with your counsel; we can help coordinate.

Should we restore from backups right away?

Not until the attacker has been removed. Restoring into a still-compromised environment often leads to reinfection. Preserve evidence, confirm backups are clean, and restore as part of a planned recovery.