On demand
You call us when the incident happens and we work with the scope needed.
Incident response
Cybersecurity incident responsefor businesses
Incident response is the work of containing an attack, removing the attacker, recovering the systems and learning so it does not happen again. We do it with a proven method (NIST SP 800-61 and ISO/IEC 27035), preserving the evidence and backed by our 24/7 SOC/MDR.
What we do when there is an incident
- 01
Detection and analysis
We confirm what happened, which systems are affected and the real scope.
- 02
Containment
We isolate compromised devices and accounts so the attack does not spread.
- 03
Eradication
We remove the attacker’s access, the malware and the cause that allowed it.
- 04
Recovery
We restore services and data from clean backups and watch that it does not return.
- 05
Lessons learned
We document what happened and strengthen the controls so it does not happen again.
How it is contracted
With a prior agreement
Response times and hours agreed in writing before anything happens.
Alongside Securiza720
Detection and containment on your devices already run 24/7 with the SOC/MDR.
Forensics and chain of custody
- We preserve the evidence (memory, disks, logs) before touching anything.
- We record who accesses each piece of evidence and when, so it holds up with an insurer or in court.
- We rebuild the attack timeline: how they got in, what they did and what they took.
Ransomware: pay or not?
- Paying does not guarantee getting the data back or that it will not be published, and it funds new attacks.
- Before deciding anything, assess with specialists whether you can recover from backups and what data was taken.
- Talk to your legal adviser and your insurer: there may be legal and policy implications.
Who to notify and by when
Depending on the company and what happened, there may be notification duties. These are the main ones:
| Who | When | Basis |
|---|---|---|
| The data protection authority (AEPD in Spain), if personal data is affected | Within 72 hours of becoming aware of the breach | GDPR, art. 33 |
| INCIBE-CERT (companies) or CCN-CERT (public sector) in Spain | Depending on the applicable regime | Royal Decree-law 12/2018 |
| Entities subject to NIS2 | Early warning within 24 h, notification within 72 h and a final report within one month | NIS2 Directive, art. 23 |
| In Portugal: CNCS | Deadlines of the national regime | Decree-Law 125/2025 |
| The police | Criminal complaint | — |
| Your cyber insurer | As per the policy | Contract |
An indicative summary, not legal advice: each case is reviewed with the company’s legal adviser or DPO.
Prepare before it happens
- A written response plan: who decides, who is called and what is done in the first hour.
- Tabletop exercises with management and the technical team.
- Isolated, tested backups and emergency contacts at hand.
Frequently asked questions about incident response
Isolate the affected devices from the network without switching them off, do not delete anything and call us. Our emergency page has the steps for the first hour.
Yes. We handle incidents on demand even if you have no prior contract with us.
It depends on the scope of the incident and the engagement model. With a prior agreement, times and hours are agreed in writing.
We help you prepare the technical information and coordinate with your legal adviser or DPO, who decide what to notify and to whom.
Need help with an incident?
Write to us with what you are seeing and we will tell you the next steps.