Under attack? Our UK incident response team is on standby.

Cyber incident response is the rapid, expert-led process of detecting, containing, investigating and recovering from an active cyber attack such as ransomware, account compromise or data exfiltration. We provide both on-call retainers and emergency engagement for SMEs across the UK, BVI and USA when something has already gone wrong. The priority order is always the same: stop the attacker’s access, preserve evidence, restore operations, then establish how they got in so it cannot happen again. We also handle the parts businesses forget under pressure, including ICO notification, insurer and legal liaison, and clear communication with staff and customers.

Call our 24/7 UK line and a senior responder engages within minutes to assess scope and impact. We isolate affected systems and revoke compromised credentials to stop the attack spreading, run a forensic investigation to identify root cause and any data exfiltration, then rebuild and harden your environment and deliver a full report for insurers and regulators.

The decisions made in the first hour of an incident — isolation, evidence preservation, communications — often determine whether you recover in days or weeks, and evidence destroyed early can invalidate insurance claims. A pre-agreed retainer means someone answers immediately and follows a proven playbook, rather than you scrambling to find help mid-crisis.

Proactive retainers start from around £250 per month and guarantee 24/7 access to our UK team at a known, capped price. Emergency engagements without a retainer are charged at our standard incident rate, quoted transparently once we understand the scope of the incident. A retainer also includes an annual review of your environment and an agreed response plan, which materially shortens response time because we are not learning your systems during the incident. For most SMEs the retainer costs less than a day of emergency response.

Initial triage begins within minutes of your call, containment is typically achieved within hours, and full investigation and recovery can range from a few days for a contained incident to several weeks for widespread ransomware, depending on backup quality and the scale of the environment affected. The single biggest factor in how long recovery takes is whether you have tested, offline backups. Businesses that do are usually operational within days; those relying on backups that turn out to be encrypted or incomplete face a far longer and more expensive recovery.

SMEs need it more, in many ways, because they rarely have an in-house team able to respond to a live incident. Average ransomware recovery for an unprepared SME exceeds 20 working days without expert support, so having a response plan matters just as much for smaller businesses as for large ones.

Retainer clients get guaranteed response SLAs, capped rates and pre-agreed playbooks, which matter enormously when minutes count. Emergency-only engagement still gets you expert help, but without the SLA guarantees, pre-agreed access, or the faster start that comes from us already knowing your environment. In practice, retained clients tend to contain incidents in hours rather than days, because access, contacts and escalation routes are already agreed. A retainer is also increasingly something cyber insurers look for, and can help at renewal.

Almost always no. Paying doesn't guarantee data recovery or that stolen data won't be leaked anyway, and it can mark you as a target for repeat attacks. We focus on recovering from backups and hardening your environment so the same attack can't succeed twice. Payment may also carry legal and sanctions implications depending on who the attacker is. Our role is to give you an honest assessment of your recovery options, the realistic timescales for each, and the evidence you need for your insurer, so the decision is a commercial one made with the facts rather than under pure panic.