---
title: 'Emergency incident response'
url: 'https://triplepoint.org.uk/security/incident-response/emergency-response'
markdown: 'https://triplepoint.org.uk/security/incident-response/emergency-response.md'
date: '2026-09-28'
description: 'Emergency cyber incident response for UK businesses. Specialist responders contain an active attack, find out how it happened and help get you running again.'
---

# Emergency incident response

The riskIn the first hours of an attack, decisions made in a hurry can make things worse: wiping machines destroys the evidence of how the attacker got in, and systems restored without closing that door can be hit again.

Most businesses have never dealt with an incident before, and it's not the time to learn.

 What it does- Specialist incident responders available 24/7, whether or not you are already a customer
- Contains and removes the attacker, then watches for signs they come back
- Finds out how they got in, so the same way in can be closed
- Checks how far the attack reached, with compromise assessment and threat hunting
- Support with ransom negotiation, if it comes to that

 Who it's forAny business dealing with an attack right now. MDR Complete customers already have full incident response included.

 How we supply itEmergency response is carried out by Sophos's incident response team and arranged through us. Contact us and we'll get it started. If you can't reach us, you can call Sophos's UK emergency line directly on **+44 1235 635329**.

 What's under the hood**Sophos Incident Response Services** — Sophos's digital forensics and incident response team, available to customers and non-customers alike.

 Questions What should we do first?+Disconnecting affected machines from the network is usually safer than switching them off or wiping them, because it keeps the evidence. Don't contact the attacker. Then get help.

 Do we need to be a customer already?+No. Emergency response is available to anyone.

 Should we pay the ransom?+That's your decision, and it may involve your insurer and legal advice. The responders can help you understand the options, and what paying would and wouldn't get you.

 How much does it cost?+It depends on the size of the incident, and the cost is agreed with you before work starts.

[← Back to Recover from an attack](https://triplepoint.org.uk/security/incident-response)

## Not sure what you need?

Tell us a little about your business and we'll recommend the controls that matter most for it — no obligation, and no jargon.

[Talk to us →](https://triplepoint.org.uk/contact?about=Emergency%20incident%20response) or [see every security area →](https://triplepoint.org.uk/security)

---

## Navigation

- Parent: [Incident response and recovery](https://triplepoint.org.uk/security/incident-response.md)
- Next: [Incident readiness](https://triplepoint.org.uk/security/incident-response/incident-readiness.md)