Cyber Incident Response & Ransomware Recovery
When systems go down, data is encrypted or a breach is suspected — every minute counts. Vertex9's incident response capability is designed to contain, recover and harden, fast.
What Counts as a Cyber Incident?
If any of the following are happening (or suspected), contact us immediately — do not wait to be certain:
Files encrypted, ransom note displayed, systems inaccessible
Suspected or confirmed unauthorised access to personal or sensitive data
Unusual email activity, sent emails you didn’t send, login from unknown locations
Antivirus alerts, unusual network traffic, unexplained system behaviour
Fraudulent invoice requests, CEO impersonation, supplier email spoofing
Website or services suddenly unavailable, unusually high network traffic
Our Response Process
Six phases from first contact to hardened, recovered systems.
Detection & Triage
Engineer picks up, assesses severity and scope. Initial advice given immediately. Remote access established to affected systems where possible.
Containment
Isolate affected systems from the network to prevent lateral movement. Preserve evidence for forensic analysis. Identify the attack vector and active threat actors.
Eradication
Remove malware, ransomware and attacker persistence mechanisms. Patch or mitigate the exploited vulnerability. Verify clean state before reconnecting systems.
Recovery
Restore systems and data from clean backups. Rebuild where necessary. Verify business functionality is restored and monitoring is active.
GDPR & Regulatory Notification
Assess breach notification obligations. Where required, assist with ICO notification within the 72-hour window and any affected data subject notifications.
Post-Incident Analysis & Hardening
Root cause analysis report. Remediation roadmap to prevent recurrence. Implementation of missing controls — EDR, MFA, patch management, awareness training.
Incident Response Services
What Vertex9 can do when an incident occurs.
Ransomware Response
Contain the spread, assess encryption scope, advise on recovery options and restore from backups where available. We do not recommend paying ransoms.
Data Breach Containment
Identify what data was accessed, by whom and how. Preserve forensic evidence and assess GDPR/ICO notification requirements on your behalf.
Business Email Compromise
Secure compromised email accounts, revoke attacker access tokens, review mail flow rules and identify any financial fraud attempts.
Network Intrusion Response
Identify compromised systems and accounts, isolate the affected network segment and remove attacker persistence before recovery begins.
Forensic Investigation
Preserve logs and system images for forensic analysis. Identify attack timeline, entry point and data exfiltration scope — critical for regulatory reporting.
ICO & GDPR Notification
Assess whether ICO notification is required. Draft and submit notification within the 72-hour window. Advise on affected data subject communications. See IT Compliance.
⚠ GDPR: You Have 72 Hours
Under UK GDPR, organisations must notify the ICO within 72 hours of becoming aware of a personal data breach that poses a risk to individuals' rights and freedoms. The clock starts when you discover the breach — not when the attack began.
Vertex9 can help assess whether a breach meets the notification threshold and assist with the ICO submission. Learn more on our IT Compliance page or read our NIS2 & UK compliance guide.
Retained MSSP vs Emergency-Only
We respond to both — but the difference in outcome is significant.
Incident response for managed clients is included in the Professional and Enterprise packages. See our pricing page for details.
Incident Response FAQs
Active Incident? Call Now.
Available 24 hours a day, 7 days a week, 365 days a year.
020 3633 9124Or submit an incident report online if you need non-urgent assistance.
Submit Incident Report