Organisation Hacked:
What Now?

A suspected cyber incident creates pressure to explain what happened before your teams have the evidence to answer. The first objective is more practical: stop the situation from expanding, protect the operations that matter most and preserve the evidence needed to understand what comes next.

Use the structure below if your organisation is facing ransomware, suspected data theft or another serious compromise. It is designed to support the opening phase, when facts are incomplete but delay can still increase the damage.

You do not need the complete picture to make the first safe containment decision.

The questions are deliberately operational. They move the response from a search for perfect knowledge towards decisions that can reduce harm while the investigation develops.

Our incident resource pack gives your teams a practical structure for the period after the first shock. It brings together three linked needs:

• Post-theft containment confirmation: check re-entry risk, egress restrictions, evidence preservation and whether the attacker is still active.
• Safe stabilisation and rebuild: sequence critical services, identity resets and validation gates before reconnecting to the wider environment.
• Damage control and communication: organise customer guidance, partner updates and decision records while facts are still developing.

Our role is to help your teams establish operational containment after prevention has been bypassed. We complement the work of your incident-response, infrastructure, legal, communications, insurer and recovery specialists; we do not replace any of them.

Our platform helps authorised teams detect and interrupt malicious behaviour, reduce spread and preserve a smaller operating environment while investigation and continuity decisions continue. Ransomware Containment is the core platform. Server Intrusion Protection and Virtual Server Protection are additional features running on it, extending the available controls to server intrusion and virtual infrastructure.

The practical value is decision space. When unsafe activity can be narrowed without disconnecting everything around it, your teams have more room to investigate, protect essential services and choose the next move on evidence rather than panic.

We support organisations rather than private individuals. If you have personally been affected by a breach, identity fraud, phishing or another online scam, contact the organisation involved and use the official guidance provided by the police, your bank or the relevant national cyber-safety service.