Emergency cyber incident response

The instinct to wipe and reinstall is understandable and it is usually wrong. Once the machines are rebuilt you cannot answer how the attacker got in, what they took, or whether they still have access, and those are exactly the questions your customers, insurers and regulators will ask.

We isolate affected systems from the network while leaving them powered where volatile memory matters, capture memory and disk images, preserve firewall, authentication and mail logs before rotation deletes them, and rotate credentials in an order that does not tip off an attacker who still has a foothold.

A single incident commander is named and a written log is started immediately, because reconstructing a timeline from memory three days later is not defensible.

The CERT-In directions of April 2022 require covered entities to report listed incident types, including ransomware, data breaches, unauthorised access and website defacement, within six hours of noticing or being notified about them. Six hours is a short window, which is why the reporting template should exist before the incident.

Where personal data is involved, the Digital Personal Data Protection Act 2023 and the DPDP Rules notified in November 2025 require notification to affected individuals and to the Data Protection Board, with details of the breach and the mitigation taken.

Regulated sectors add their own duties, such as the SEBI cyber security and cyber resilience framework for market intermediaries. We help you meet the deadline with accurate content rather than a rushed filing you later have to correct.

Investigation answers four questions: how entry was gained, how long the attacker was present, what was accessed or exfiltrated, and whether persistence remains. Answering the fourth properly is what stops the same incident happening again a fortnight later.

Eradication means closing the entry point, removing web shells, scheduled tasks, rogue accounts and mail forwarding rules, and resetting authentication material including service accounts and API keys that are usually forgotten.

Recovery is staged and verified. Backups are restored to a clean, segmented environment, checked for the same implant, and only then returned to service, with monitoring raised for a defined period afterwards.

Every engagement ends with a written report covering the timeline, root cause, scope of impact, actions taken and the evidence supporting each conclusion. It is written to be readable by your board and defensible to an assessor.

The recommendations are ranked by how much risk they remove per rupee spent. In most cases the top items are unremarkable: multi-factor authentication everywhere, tested offline backups, network segmentation and a patching routine with an owner.

We also rehearse the plan with you afterwards. A tabletop exercise that surfaces who calls the bank at eleven at night is worth more than another tool.