Incident Response

What is incident response?

Incident response is what needs to happen when your organisation has been hacked. Ransomware, data breaches, Business Email Compromise, unauthorised access, a suspicion that someone is in your network - we help contain the incident, find the cause and recover.

Our team thinks like attackers - because that is what we are daily as pentesters. We quickly understand how an attacker got in, which tools they used and what traces they leave. That makes us effective in incident response.

When should you engage us?

• Ransomware: systems encrypted, ransom demand received
• Suspected intrusion: unexplained activity in network or cloud
• Business Email Compromise: email accounts taken over, fraudulent payments
• Data breach: indication that sensitive data has been stolen
• Malware: systems showing suspicious behaviour
• Account takeover: admin accounts or cloud tenant compromised

Why Zolder for incident response?

During an incident every minute counts. You need a team that:

• Is immediately available: we respond 24/7. Call us, and we are there. No ticket system, no queue.
• Thinks offensively: our pentesters understand attack techniques from the inside. We quickly recognise which tools an attacker has used.
• Gets hands dirty: we deliver concrete, hands-on help. Forensic analysis, containment, recovery. Not theory.
• Advises independently: we do not sell security products. Our advice is purely focused on resolving the incident.

Our approach

Based on NIST SP 800-61, but put into practice by researchers who know how attackers work:

• Triage & intake - rapid assessment: what happened, what is the scope, how bad is it? Initial assessment of the attack type.
• Containment - immediate actions: isolating compromised systems, blocking suspicious accounts, activating network segmentation. We act fast.
• Forensic investigation - analysing log files, disk images, memory dumps, network captures. Establishing cause, attack path and scope.
• Eradication - removing malware, closing access, resetting compromised credentials.
• Recovery - controlled restoration from clean backups. Verification that the attacker has not left persistence.
• Reporting & lessons learned - incident report with timeline, root cause analysis and recommendations. Usable for law enforcement, insurance and regulators.

What does incident response cost?

Our hourly rate for incident response is €250 per hour (excl. VAT). This reflects 24/7 availability, urgency and specialist expertise. Costs depend on:

• Severity: a BEC versus a full ransomware attack with lateral movement.
• Work required: triage and containment only, or also extensive forensic investigation.
• Duration: small incidents in days, complex attacks in weeks.

Suspect an incident? Call us for a brief free assessment. Direct contact, no queue.