Get the latest cyber news and updates straight to your inbox.
A field guide for finance leaders, from our incident response team
“I can’t access any of my files” might mean one failed laptop. It might mean the whole company has been encrypted. Bring experienced incident responders in early. They have seen it before, bring calm judgement and specialist skills, and help you assess the scale, limit the damage and restore critical services faster.
This is the sequence our incident response team follows on real attacks.
Establish what is affected and what the business can no longer do. Which systems and critical services are involved? Can customers transact? What evidence do you have, and how far has the attack spread?
You will not have the full picture yet. You need enough to judge the severity, protect critical services and set priorities, because every decision after this one rests on that assessment.
Find out what you can do to protect your business. Talk to a cybersecurity expert today.
An attacker moving through a network takes time. Containment takes that time away, but it demands deliberately disruptive decisions.
Disconnect affected devices from the network, remove external access and lock accounts, including apparently clean systems if leaving them connected could let the attack spread. Do not shut devices down indiscriminately: powering off can destroy volatile forensic evidence, so take specialist advice first.
FoxTech DEFEND keeps audit logs centralised and searchable when systems are isolated, helping you assess the attack and provide firmer evidence to regulators and insurers. Containment can feel drastic. It is almost always cheaper than letting the attack continue.
“The right containment decision may feel drastic. It is almost always cheaper than allowing the attack to continue.”
This runs alongside containment and recovery, not after them. Regulatory notification deadlines can start quickly. Under UK GDPR, certain personal data breaches must be reported to the Information Commissioner’s Office within 72 hours of becoming aware of them, and regulated organisations may have additional notification obligations. You do not need every answer before making an initial notification.
Speak to your insurers and lawyers early. Then establish how you will reach people if your own systems are unavailable. Customers, staff, the board and other stakeholders need a trusted route for updates, especially when email, phones or internal platforms cannot be relied upon.
Recovery is the long phase. You are deciding what is genuinely clean, what can be restored and what is safer to rebuild.
Sequence the work by business impact. Customer transactions and critical operational services come before management reporting. Expect the most important systems back first, followed by a long tail of smaller ones, and take the time to recover each safely.
Do not automatically rebuild everything exactly as it was. Recovery is also an opportunity to remove known weaknesses, retire obsolete systems and make deliberate improvements where they will not delay critical business restoration.
Get a free CyberRisk Report to understand your firm's risk exposure.
Once the immediate crisis has passed, establish what happened, what the attacker accessed, which controls failed and why. Forensics may be required, but the objective is broader than attribution: identify the changes needed to prevent a repeat.
Document the lessons, assign named owners and deadlines, and track remediation through to completion. Leadership should be able to show customers, regulators, insurers and the board that the organisation responded appropriately and is better prepared as a result.
FoxTech’s incident response team has helped organisations contain and recover from serious cyber incidents, including ransomware attacks requiring entire estates to be rebuilt. We also run incident response readiness reviews and exercises, helping leadership teams understand their roles, test their plans and identify gaps before a real incident exposes them.
Whether you are strengthening your readiness or dealing with an active incident, our team can help you move forward with clarity and control.
Worth a conversation before you need us. foxtechcyber.com · info@foxtechcyber.com
Try the DEFEND SOC for free. Full time monitoring and response from a team of security experts.
Your organisation’s greatest security risk isn’t a shadowy hacker in a hoodie – it’s the well-meaning employee who shares passwords to meet a project deadline, uses Dropbox because the approved file-sharing system is too slow,
On the surface, Managed Service Providers (MSPs) make perfect sense: a single provider managing IT, security, and support—all for a predictable monthly fee.
But for mid-sized, regulated organisations, that simplicity often masks a deeper issue:
Many businesses believe that installing anti-virus software is sufficient to protect them from potential hacks, breaches, or ransomware.
