Ransomware, a compromised mailbox or an unexplained data transfer forces decisions under pressure: what to isolate, whom to notify, whether systems can be trusted and how to keep the business running. Acting too fast can destroy evidence; acting too slowly lets the attacker go further.
ZERYON's incident response team brings method to that moment. We coordinate containment, preserve and analyse evidence with forensic rigour, identify how the attacker got in and what they did, and guide recovery so that the same door is not left open. Throughout, we help you communicate calmly and with facts to management, authorities, insurers and, where needed, customers.
What's included
Emergency response
Remote and, where needed, on-site support to triage, contain and eradicate an active threat. For retainer and MDR clients, our target engagement time for critical incidents is under 15 minutes.
Digital forensics
Acquisition and analysis of disk, memory, log and cloud evidence with a documented chain of custody, to establish the timeline, entry point and scope of the compromise.
Ransomware and extortion response
Containment, impact assessment, recovery from clean backups and support with the decisions extortion raises, alongside your legal advisers and insurer.
Business email compromise
Investigation of compromised mailboxes and cloud identities, malicious inbox rules and fraudulent payment requests, followed by clean-up and hardening.
Crisis management
Support for your crisis committee: decision logs, stakeholder updates and help preparing notifications to the authorities.
IR retainer and preparedness
Terms and contacts agreed in advance so work starts without delay, plus response plans, playbooks and tabletop exercises to practise before it is real.
How we work
Triage and containment
We assess the situation, agree priorities with you and apply containment that stops the spread without destroying evidence.
Investigation
We collect and analyse evidence to reconstruct the timeline: how the attacker entered, what they accessed and whether they are still present.
Eradication and recovery
We remove persistence, close the entry points and support an orderly restoration of systems and accounts, verifying they are clean.
Lessons learned
A final report with findings, root cause and recommendations, and a session to turn them into concrete improvements.
What you get
Control in the first hours
A clear plan and experienced people directing the response from the outset.
Facts you can rely on
A forensic timeline and scope that support decisions, notifications and, if needed, legal or insurance processes.
A clean recovery
Systems restored with confidence that the attacker no longer has access.
Stronger defences
Root-cause fixes and preparation that reduce the impact of the next incident.
Who it's for
- Organisations dealing with an active incident right now: ransomware, a compromised account or suspicious activity.
- Companies that want an incident response retainer in place before they need it.
- Entities under NIS2 or DORA that must manage and report significant incidents within strict deadlines.
- Businesses that need forensic evidence for insurers, legal advisers or authorities.
Frequently asked questions
What should I do first if I suspect a cyber attack?
Stay calm and avoid switching off or wiping affected systems, as that can destroy evidence. Isolate them from the network if you can, preserve logs, change credentials from a clean device and contact an incident response team. Write down what you saw and when.
What is DFIR?
DFIR stands for digital forensics and incident response. It combines the immediate work of containing and resolving an incident with the forensic analysis that establishes what happened, how and with what impact, preserving evidence for later use.
What is an incident response retainer?
An agreement signed in advance that sets out how and how quickly we respond, whom to call and the terms of the service. When an incident happens there is no contract to negotiate, so work starts straight away. Retainers usually include preparation, such as plan reviews and exercises.
What are the incident reporting deadlines under NIS2?
Entities in scope must send an early warning of a significant incident within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report within one month of that notification. Separately, the GDPR requires personal data breaches to be notified to the supervisory authority within 72 hours where feasible.
Should we pay a ransom?
That decision belongs to your organisation, with legal advice, and it raises legal, ethical and practical issues: paying does not guarantee recovery or the deletion of stolen data. Our role is to give you the facts, from scope to backup status and recovery options, and to restore operations without paying wherever possible.