Quick answer: If your company has been hacked, the first hour decides how much it costs. Stop the spread, keep evidence, and get a trained responder on your systems. ITSECOPS runs incident response from a staffed 24/7 delivery center with offices in Kansas City (USA) and Stavanger (Norway). Fill in the form, a senior incident responder calls you within 30 minutes, confirms the scope, and the 5 hour investigation and containment package starts on that call.
- Ransomware and encrypted files
- Data breach or data leaking out (DLP)
- DDoS: website or services down
- Website hacked, defaced or redirecting
- Zero day or exploited vulnerability
- Email account takeover (BEC)
What happens in the first 5 hours
| Time | What the ITSECOPS responder does | What you get |
|---|---|---|
| 0 to 30 min | Callback from a senior incident responder. Scope, affected systems, what to switch off and what to leave on (evidence). Fixed price confirmed. | Immediate instructions: isolate, do not wipe, do not pay, preserve logs |
| 30 to 90 min | Containment. Isolate affected endpoints and servers, disable compromised accounts, block attacker infrastructure at the firewall, identity and email layer, revoke sessions and tokens, stop data leaving (DLP rules, block uploads). | The spread stops. Attacker access is cut |
| 90 min to 3 h | Investigation. Entry point, timeline, lateral movement, persistence (new admin accounts, scheduled tasks, mailbox rules, OAuth apps), what data was touched. Works with your MDR or EDR (Huntress, Sophos, Defender, CrowdStrike, SentinelOne, Acronis) and your Microsoft 365 or Google Workspace tenant. | Confirmed root cause and scope |
| 3 to 5 h | Report and next steps. Written incident summary, indicators of compromise, what to tell insurers, regulators (GDPR 72 h, NIS2 24 h early warning, US state and sector rules) and customers, recovery plan with priorities. | Board ready report. Clear recovery plan, with or without ITSECOPS |
If recovery needs more than 5 hours (ransomware rebuilds, large tenants, forensic preservation for legal or insurance), you decide after the report whether to continue on an hourly basis or a fixed recovery scope. Nothing is extended without your approval.
Incident types we respond to
Ransomware attack response
Files encrypted, a ransom note on screens, backups deleted. We isolate what is still clean, identify the strain and entry point, check whether data was exfiltrated before encryption (double extortion), and start recovery from verified backups. We do not advise paying before the investigation; many payments do not return usable keys and some are illegal under sanctions rules.
Data breach and data leak (DLP emergency)
Data leaving through a compromised account, a misconfigured share, a vendor API or an insider. We find the channel, stop it (Microsoft Purview DLP, conditional access, token revocation, egress blocks), establish what left and when, and prepare the notification timeline for GDPR, NIS2, HIPAA or US state breach laws.
DDoS attack mitigation
Website, VPN, email gateway or public API flooded. We move DNS behind a mitigation layer (Cloudflare or your provider’s scrubbing), apply rate limits and geo rules, protect the origin IP, and confirm the DDoS is not a cover for a second intrusion, which is common.
Website hacked, defaced or redirecting
WordPress, Magento, custom PHP or Node sites: injected scripts, SEO spam, credit card skimmers, redirects, admin backdoors. We take a forensic copy, clean or restore, rotate every credential, patch the entry point, and file the Google Search Console security review so your traffic recovers.
Zero day and actively exploited vulnerabilities
Edge devices and appliances (Citrix NetScaler, Fortinet, Ivanti, Palo Alto, Cisco, Exchange, VMware) are where most 2026 mass exploitation starts, and most of them run no EDR agent. We confirm exposure, apply the vendor mitigation or patch, hunt for webshells and persistence, and rotate the credentials the device held.
Email account takeover and business email compromise
Mailbox rules forwarding invoices, payment detail changes, MFA fatigue. We revoke sessions, remove rules and rogue OAuth apps, reset and re enrol MFA, check for the second mailbox the attacker usually has, and trace which invoices were altered.
Why ITSECOPS for an emergency
- Staffed 24/7, not on call. The Sophos Active Adversary Report 2026 found 88% of ransomware was deployed outside business hours. Our delivery center is staffed at 2 am on a Sunday, which is when the callback promise matters.
- The layer after your MDR. Vendor SOCs isolate the endpoints their agent sees. We take it from there: identity, email, firewalls, appliances with no agent, root cause and hardening. See what happens after MDR isolates a machine.
- Compliance aware from minute one. CISA led team with SOC 2, ISO 27001, CMMC, NIS2, HIPAA and GDPR practice, so evidence, notifications and insurer requirements are handled during the incident, not after.
- Where you are. Offices in Kansas City, Missouri and Stavanger, Norway; 24/7 delivery center in Noida, India; English, Norwegian and Hindi speaking responders.
Questions companies ask when they have just been hacked
We have been hacked. Who do we call first?
Call an incident response team before anyone touches the affected systems, then your cyber insurer (most policies require notification within 24 to 72 hours and some name approved responders), then legal. Internal IT or your MSP should isolate, not investigate, until a responder sets the evidence rules. Use the form on this page for a 30 minute callback, 24/7.
Should we switch everything off?
Disconnect affected machines from the network (unplug the cable, turn off Wi Fi) but do not power them off and do not wipe or reinstall. Memory and logs hold the evidence that shows what the attacker reached. Leave backups disconnected from the network until a responder has checked them.
Should we pay the ransom?
Not before an investigation. Payment does not guarantee working keys or deletion of stolen data, may breach sanctions law, and is often unnecessary when clean backups or decryptors exist. The 5 hour package establishes whether you need to negotiate at all.
What does the 5 hour investigation and containment package include?
A senior responder for 5 hours of continuous work: callback and scoping, containment of the active threat, investigation of entry point and scope, and a written report with indicators of compromise, notification obligations and a recovery plan. Fixed price, confirmed on the callback before work starts. Anything beyond the 5 hours is your decision after the report.
Do you work with our existing MDR, EDR or MSP?
Yes. We run incidents alongside Huntress, Sophos, Microsoft Defender, CrowdStrike, SentinelOne, Acronis and other platforms, and alongside your MSP. MSPs also engage us as white label incident response for their clients.
What are the legal deadlines after a breach?
GDPR: 72 hours to the supervisory authority once you are aware of a personal data breach. NIS2 (EU essential and important entities): early warning within 24 hours, incident notification within 72 hours, final report within one month. HIPAA: 60 days to individuals and HHS. US state breach laws vary, several set 30 to 45 days. CMMC and DFARS contractors: 72 hours to DoD via DIBNet. The report from the first 5 hours gives you the facts those notifications need.
Can you help if we are a small company with no IT team?
Yes. Most emergency requests come from companies of 10 to 250 people with one IT person or an MSP. The responder talks to whoever has admin access and does the technical work remotely with your approval.
Where are you located and do you respond remotely?
Offices in Kansas City (USA) and Stavanger (Norway), with a staffed 24/7 delivery center in Noida (India). Containment and investigation are done remotely within minutes; on site support is arranged in the US and Europe when physical access is needed.
Why do you reject personal email addresses on this form?
The line is kept free for companies under attack. A work email at your company domain and a phone number that answers are the quickest way for us to confirm the request is real and reach the right person. If your email is down because of the incident, use the phone numbers above or write to mitigation@itsecops.cloud from any account and include a phone number.
Request the 30 minute callback Not an emergency? See who responds to a weekend cyberattack, 24/7 SOC monitoring or managed detection and response so the next one is caught early.