Incident Response Ransomware

In a ransomware attack every minute counts. Our DFIR team responds H24: immediate containment to stop propagation, forensic analysis to determine the entry vector, secure system recovery, and support in communicating with stakeholders, authorities and insurers.

H24 Immediate response, 365 days a year

<2h Average time to first response

100% Cases managed with evidence preservation

NIS2 CSIRT-IT notification support included

When to call us

Active ransomware — encrypted systems

Your systems have been encrypted. You are seeing ransom demands. You need to immediately contain the spread and evaluate your options.

Confirmed or suspected data breach

You have detected unauthorised access or data exfiltration. You need to understand what was taken and assess notification obligations.

Suspicious activity on systems

You notice anomalous behaviour: accounts acting outside business hours, unusual network traffic, services disabling themselves. This could be the pre-ransomware phase.

After an incident — ready for next time

You have suffered an attack. You want to understand exactly what happened, harden your systems and build an Incident Response Plan before it happens again.

What we do

Immediate containment: isolation of compromised systems
Forensic analysis of the attack vector and infection
Digital evidence acquisition (chain of custody)
Propagation assessment and identification of infected systems
Support for secure recovery from verified backups
Communication with CSIRT-IT (NIS2 obligations)
Support for management, insurers and legal counsel
Post-incident report with timeline, root cause and remediation

What you receive

Containment report (immediate actions taken)
Complete forensic analysis of the vector and attack
Evidence report with chain of custody
Full incident timeline (kill chain reconstructed)
NIS2 / GDPR notifications drafted and submitted
Post-incident remediation and hardening plan
Technical report for legal and insurance use

Target

CEO / DG IT Manager / CTO CISO Legal & DPO Risk & Insurance Manager

FAQ

Should I pay the ransom?

Our team never recommends payment as a first option. In many cases it is possible to restore systems without yielding to extortion, also thanks to any publicly available decryptors. Each situation is assessed on a case-by-case basis, taking into account the ransomware variant, available backups and operational impact.

How long does recovery take?

Timelines vary depending on infrastructure size, availability of verified backups and attack complexity. Our objective is to restore at least critical functions within 48–72 hours of containment. Full recovery may take from 1 to 4 weeks.

Are you available outside business hours?

Yes. The emergency line is active H24, 7 days a week, 365 days a year. Out-of-hours calls are handled by the on-call team with the same SLA as business hours. Call +39 04221490378.