IR

How it works

• Detect and confirm what happened.
• Contain it: isolate affected machines and disable stolen accounts.
• Clean up, recover from backup, and find how the attacker got in.
• Tell the people who need to know, and write down what changed.

What can go wrong (example scenario)

A five-person engineering firm found ransomware on a Monday. With no plan, staff kept working on infected machines, the owner reset the one PC he could see, and the attacker encrypted everything again on Wednesday. The backup had been reachable the whole time.

How WILDCARD handles it

Cyber is active breach isolation: it contains the threat as well as reporting it. Workstation Defender and Identity Monitor provide the detection and automatic shutdown that start a response, and Unified Backups is the recovery.

• A dental office's staff member reports clicking a link; the account is isolated and the session revoked within minutes.
• A law firm's server shows encryption behaviour; the machine is cut off the network while the rest keep working.
• A retailer finds its mailbox sending spam; the account is locked, rules cleaned and the password reset.

Example scenario: A small architecture firm's receptionist approved an MFA prompt she had not asked for. The response: her session was revoked, the password reset, a hidden inbox rule deleted and every message sent in the last hour reviewed. Two clients got a short heads-up about a suspicious email. Total time: ninety minutes.

A question owners ask

What should I do in the first five minutes of an incident?

Call the person responsible for your response, keep the affected device on but off the network, and change nothing else. The worst moves are turning things off, deleting things, or hoping it goes away.