Every organization will eventually face a security incident. The only variables are when, how bad — and whether you notice in hours or in months.
The difference between an inconvenient Tuesday and an existential crisis is rarely the attack itself. It is the speed and quality of the response.
Key takeaways
- Decide roles, communication paths and backup strategy before the incident.
- Isolate compromised hosts — don’t power them off; memory holds evidence.
- Understand the entry point before wiping, or the attacker returns next week.
- GDPR gives you 72 hours for certain notifications — have that assessment ready.
Prepare: decisions made in advance
Decide now who leads, who can take systems offline, who talks to lawyers and regulators, and how you communicate if email itself is compromised.
Keep offline backups and actually test restoring them. A one-page plan everyone knows beats a fifty-page binder nobody has opened.
Detect: noticing early
- Centralize logs — you cannot investigate what you never recorded.
- Alert on high-signal events: impossible-travel logins, failed-login storms, new admin accounts, mass file changes.
- Deploy EDR for real visibility into process activity.
- Take human reports seriously — “my PC is acting strange” is how many incidents surface.
Contain: stop the bleeding, keep the evidence
Isolate affected hosts from the network rather than powering them off — memory holds evidence. Disable compromised accounts, revoke sessions, rotate exposed credentials, block attacker infrastructure.
Resist the instinct to immediately wipe and reinstall: erase the trail before understanding the entry point, and the attacker returns through the same door next week.
The damage is decided by response speed — not attack brilliance.
Recover — and run the honest post-mortem
Remove the attacker’s access everywhere at once — malware, backdoors, rogue accounts — then restore from clean backups and monitor for return attempts.
Afterwards: a no-blame post-mortem. What was the entry point? What slowed detection? Which control would have broken the chain? Feed the answers back into your defenses.
If you lack in-house response capability, arrange external support before you need it. Response that starts within hours, with a partner who knows your environment, is a different sport from a cold call at 3 a.m.
Related service: Altrixys offers incident response services for organizations that want this handled by specialists.
Altrixys provides authorized penetration testing, security hardening and compliance services from Athens, Greece. Want to know how your organization would hold up against a real attack? Request a free assessment.