If your business has just experienced a cyber attack, the way you respond in the first few hours can either contain the damage or make it worse.
The wrong move can spread the issue further, interrupt critical systems, or make recovery harder than it needs to be. That’s why having a clear response in place helps you stay in control.
Pause and Assess What’s Happening
The first step is to slow down and avoid reacting too quickly. Acting without understanding the situation can spread the issue, affect more systems, or remove important evidence.
Start by getting a clear picture of what’s happening. Look for signs like:
- Users being locked out of accounts
- Unexpected password reset prompts
- Missing or encrypted files
- Unusual login activity
- Suspicious emails or payment requests
- Systems behaving differently from normal
Then ask:
- What systems or accounts are affected?
- Who’s involved?
- Is the activity still ongoing?
- Are any critical systems at risk?
- Could sensitive data be exposed?
Contain the Threat Quickly
Once you suspect an incident, the priority is to stop it from spreading.
Focus on isolating what’s affected without disrupting everything else. Shutting down too many systems at once can create confusion, while acting too slowly can allow the issue to spread further.
Common containment steps include:
- Disconnecting affected devices from the network
- Disabling compromised accounts
- Forcing password resets for key users
- Pausing remote access if needed
- Restricting access to shared drives or cloud platforms showing unusual activity
If you have IT support or security monitoring in place, escalate the issue immediately so investigation can begin while the activity is still visible.
Avoid wiping devices or restoring systems at this stage. That can remove the information needed to understand what happened and whether access is still active.
Investigate What Was Accessed or Compromised
Once the immediate threat is contained, the next step is to work out what actually happened.
You’re trying to understand how the incident started, what’s been accessed, and if it’s still active. Without that, it’s hard to know if the issue is fully under control or if there’s still a way back in.
In most cases, this comes down to things like phishing emails, stolen credentials, malware, ransomware, or unauthorised access. The cause matters because it affects what needs to be fixed.
As you go through this, keep track of what you find. Logs, alerts, emails, timestamps, even notes from staff — all of it helps build a clear picture of what’s going on.
If there’s any chance sensitive or personal information has been exposed, you’ll also need to consider whether it needs to be reported.
Communicate Clearly and Early
Once you understand what’s happening, make sure the right people are informed.
Start internally. Let leadership, IT, and anyone responsible for operations or compliance know what’s going on. Make sure people understand the situation and what they’re expected to do next.
Unclear communication can lead to people continuing to use affected systems, missing important warnings, or making the situation harder to manage.
If clients, suppliers, or external partners are involved, communication should be accurate and measured. Avoid guessing or sharing unconfirmed details. It’s better to be clear about what you know and what you’re still working through.
If the incident involves sensitive data, you may also need to consider whether there are formal reporting obligations.
Recover Systems Safely
Recovery should only start once you’re confident the issue has been contained and you understand what caused it.
Moving too early can bring the problem back or leave gaps that haven’t been addressed.
For most businesses, recovery involves restoring clean backups, rebuilding affected systems, and securing any accounts that were involved. Before bringing everything back online, take the time to check that systems are working properly and that your data is intact.
This is also where many issues resurface, so it’s important to monitor closely as systems are restored.
Learn From the Incident and Strengthen Your Defences
Once things are back under control, take the time to review what happened.
Look at how the incident started, how it was handled, and where things could have been caught earlier or managed better. This is usually where gaps become clear. Remember that the goal is to reduce the chance of it happening again and not just to fix the problem.
That means tightening controls, improving visibility, and making sure there’s a clear response process in place before the next incident.
Detection and Response Support
Managing a cyber incident properly isn’t easy without dedicated cyber security support.
Holocron Sentry gives you visibility over what’s happening and support when something goes wrong. You’re not left working it out on your own or making decisions under pressure.
Get in touch with if you want support in place before something happens.
