Cybersecurity Incident Response Services
When something goes wrong, the first hour decides the outcome.
A clear plan and a team that picks up the phone turn a possible disaster into a contained incident. We prepare you before an attack and respond fast if one happens.
Incident response, answered directly
By Joe Engelking, CEO. Updated October 2026.
What is cybersecurity incident response?
Incident response is the process of detecting, containing, and recovering from a security incident such as ransomware, a compromised email account, or a data breach. It covers who does what, how the threat is stopped, how systems are restored, and who must be notified.
What should a business do in the first hour of a cyberattack?
Disconnect affected devices from the network without powering them off or deleting anything, change passwords from a clean device, and call your IT provider and your insurer right away. Write down what you saw and when. Do not wipe machines or contact the attacker before you know what you are dealing with.
Can incident response recover files encrypted by ransomware?
Only if a clean, recent backup exists. Whatever changed since the last good backup is lost, and paying a ransom does not guarantee you get anything back. We take calls from owners in exactly this situation, and the honest answer without a usable backup is that there is nothing we can do for the data already gone.
What does an incident response plan include?
A plan lists who to call, who makes decisions, how to isolate systems, how to restore from backups, how to communicate with staff and customers, and when to notify your insurer and legal counsel. It is written and rehearsed before an incident, because nobody thinks clearly in the middle of one.
IBM’s 2025 Cost of a Data Breach report put the average cost of a U.S. data breach at $10.22 million, across organizations of all sizes.
Source: IBM Cost of a Data Breach 2025| Step | Do this | Avoid this |
|---|---|---|
| Affected devices | Disconnect from the network | Powering off or wiping right away |
| Passwords | Change from a clean device | Changing them from the infected one |
| Evidence | Note what you saw and when | Deleting files or logs |
| Contacts | Call IT and your insurer promptly | Waiting to see if it goes away |
| Ransom demand | Get expert advice first | Paying or replying immediately |
A phishing attack caught before it spread
Hansen & Cleary, a law firm client, runs Todyl monitoring on Office 365 and email. When a suspicious link was clicked and strange activity started on the administrative assistant’s account, we got an instant alert and a call, reset her password, and stopped the attacker before any damage.
Joe Engelking, CEO
When ransomware hits and there is no usable backup
We regularly get calls from business owners who have just been hit by ransomware and want us to recover their files. Often there is no backup at all, or the newest one is three months old. We tell them plainly that there is nothing we can do about what is already gone.
Going forward, we can put a real solution in place, with automated backups that are tested so the next bad day is a restore and not a disaster.
Joe Engelking, CEO
More questions about incident response
Monitoring detects unusual activity as it happens, so response starts in minutes instead of whenever someone notices. In practice that means an alert and a call, a fast password reset or device isolation, and containment before the attacker does real damage.
It depends on the type of data and the law that applies. Illinois, for example, has a data breach notification law that generally requires notifying affected residents. Talk to an attorney about your specific situation, and tell your insurer early, because many policies have notice requirements.
Many policies cover response costs such as forensic investigation, legal advice, and notification, but terms vary widely. Read your policy now, find the insurer’s hotline, and know how quickly you must report an incident. We also help complete the security questionnaires insurers send.
Incident response deals with the security event itself: stopping the attacker and removing the threat. Disaster recovery restores systems and data afterward. They overlap during a ransomware attack, which is why your plan should cover both and why tested backups matter so much.
Our monitoring runs around the clock, and alerts reach a person who acts. For problems that need hands on the equipment, we can be on-site from our Hoffman Estates office. Speed matters most in the first hour, which is why we focus on detection and a rehearsed plan.
After containment, we find how the attacker got in and close that gap, whether it was a stolen password, an unpatched system, or a missing control. Then we review the plan, test the backups again, and train staff on what happened so the lesson sticks.