IT Security Incident?
We help immediately.
Every minute counts during a cyberattack. Our skilled Incident Response Team is there day and night. We stop the attack from spreading and keep the damage low.
Immediate Steps During a Security Incident
Take these steps while you wait for our team.
Stay calm
Panic leads to mistakes. Take a deep breath and work step by step.
Isolate systems
Cut affected systems off from the network. But do NOT turn them off.
Preserve evidence
Do not change anything on affected systems. Write down what you see and take photos.
Contact us
Call us right away. Our Incident Response Team takes over from there.
Our Incident Response Process
Identification & Analysis
We look at what happened and find out how the attackers got in. Then we check how much of your IT they reached.
Containment
We act at once to stop the attack. That keeps it from doing more harm to your systems and data.
Eradication
We remove the malware and close the security gaps. Then we clean up every system the attackers touched.
Recovery
We bring back your systems and data in a safe way. And we check that every threat is truly gone.
Documentation & Lessons Learned
You get a detailed report on what happened and what we did. It also shows how to stop the next attack.
Scenarios we see every day
The better we know what kind of incident is going on, the faster we can respond. The cases below make up more than 80 % of the emergency calls we get. They come from fields such as manufacturing, trades, healthcare, local government, energy supply, logistics and financial services.
Ransomware & encrypted file servers
It hits everyone from construction companies to medical practices. Typical entry points are exposed RDP services, compromised VPN access and opened phishing attachments. We isolate systems and secure forensic artefacts. We assess the payment question with you and restore business capability by priority.
Business email compromise (BEC) & invoice fraud
Compromised Microsoft 365 mailboxes, manipulated SMTP rules, CEO fraud and fraudulent payment requests. We review your MFA configuration, inspect audit and unified-audit logs and identify mailflow rules. We also support communication with banks and insurers.
Data exfiltration & GDPR notification
Data leaves via cloud storage, USB media or API abuse. We assess the type, scope and sensitivity of the affected data. We support the 72-hour notification to the supervisory authority and help structure messages to affected individuals.
Compromised cloud & SaaS accounts
AWS, Azure or Google Cloud root accounts, tenants infiltrated via OAuth apps, token theft by info-stealers. We revoke sessions, rotate keys and review IAM policies. We analyse CloudTrail and Entra ID logs for traces of the attacker.
Insider incidents & sabotage
Quiet departures with data exfiltration, disgruntled admin accounts, deliberate sabotage. We run discreet forensics and produce legally usable documentation, considering labour law, criminal code and GDPR. We coordinate communication with HR, data protection and legal.
KRITIS / NIS2 notifiable incidents
Some incidents must be reported under KRITIS, NIS2, the German Energy Act or BSIG. We walk you through all deadlines: 24-hour early warning, 72-hour incident notification and a final report within one month. This includes the technical documentation required by the BSI and the supervisory authorities.
Frequently asked questions on incident response
These are the questions we hear most often in an emergency. Our answers are short and honest. If you have more questions, call our emergency hotline at any time.
- How fast can you be operational remotely or on site in an emergency?
- After your call, you quickly reach a qualified incident responder. Remote access for technical triage is usually active within one hour. On-site deployment in North Rhine-Westphalia, the Rhineland and the Ruhr area starts within four to eight hours, depending on the time of day.
- What does an incident-response engagement cost?
- The first call, including an initial assessment of the situation, is free. After that we work on a day-rate basis with transparent time budgets. For SMEs we recommend our incident-response retainer. A small monthly fee secures guaranteed response times and sets up the contractual and organisational basics in advance.
- Should we pay the ransom in a ransomware case?
- We generally recommend checking all alternatives first: backups, decryption tools (e.g. via NoMoreRansom.org), legal advice and insurance requirements. Paying guarantees neither recovery nor that the attacker keeps your data confidential. It may also be a problem under sanctions or tax law. We assess the situation with you in a structured way.
- How do you document the incident in a legally usable way?
- We log every forensic step. Evidence is preserved to recognised standards (BSI guide, NIST SP 800-86) and tracked with hashes and chain of custody. The final report is built for use with supervisory authorities, insurers and, if necessary, in criminal proceedings.
- Do you also support communication with customers, employees and authorities?
- Yes. Together with our network of data protection officers and specialist lawyers, we provide templates and expertise. This covers GDPR notification, KRITIS/NIS2 notification, client communication, internal employee updates and press statements. You decide, we support.
- What happens after the acute phase?
- After containment and recovery, we hand over a structured report. It includes a root-cause analysis, concrete hardening recommendations and a prioritised action list. On request we help with implementation, set up a SOC/SIEM or build an incident-response plan. That way you are clearly better prepared for the next incident.
- Do you work with cyber insurers?
- Yes. We know the processes of common cyber insurance policies (including Hiscox, Allianz, AIG, Chubb). We meet their evidence-preservation and documentation requirements. When needed, we coordinate directly with your insurer or panel forensic provider.