Recover from an attack

Emergency incident response

If you're under attack right now, get specialist help in. Contain the attack, find out how it happened, and get back up and running.

Ask us about this
The risk

In the first hours of an attack, decisions made in a hurry can make things worse: wiping machines destroys the evidence of how the attacker got in, and systems restored without closing that door can be hit again.

Most businesses have never dealt with an incident before, and it's not the time to learn.

What it does
  • Specialist incident responders available 24/7, whether or not you are already a customer
  • Contains and removes the attacker, then watches for signs they come back
  • Finds out how they got in, so the same way in can be closed
  • Checks how far the attack reached, with compromise assessment and threat hunting
  • Support with ransom negotiation, if it comes to that
Who it's for

Any business dealing with an attack right now. MDR Complete customers already have full incident response included.

How we supply it

Emergency response is carried out by Sophos's incident response team and arranged through us. Contact us and we'll get it started. If you can't reach us, you can call Sophos's UK emergency line directly on +44 1235 635329.

What's under the hood

Sophos Incident Response Services — Sophos's digital forensics and incident response team, available to customers and non-customers alike.

Questions
Disconnecting affected machines from the network is usually safer than switching them off or wiping them, because it keeps the evidence. Don't contact the attacker. Then get help.
No. Emergency response is available to anyone.
That's your decision, and it may involve your insurer and legal advice. The responders can help you understand the options, and what paying would and wouldn't get you.
It depends on the size of the incident, and the cost is agreed with you before work starts.

← Back to Recover from an attack

Not sure what you need?

Tell us a little about your business and we'll recommend the controls that matter most for it — no obligation, and no jargon.

Talk to us → or see every security area →