Cyber incident response, before and after an attack
Get help containing and recovering from a cyber incident, and prepare your business with a clear response plan your team has actually practised.
The challenge
The first hours after an incident matter most
When an email account is compromised or ransomware appears, decisions get made under pressure. Without a plan, teams lose time working out who to call, what to switch off and what to tell customers.
A slow or disorganised response can turn a contained problem into days of downtime, lost data and reporting obligations.
Signs you need a plan
- No one knows who makes decisions during an incident
- Backups have never been restored under pressure
- No list of who to notify and when
- Logs aren’t kept long enough to investigate
- The plan, if there is one, has never been tested
What’s included
Incident response services
Every arrangement is scoped around your business, but most include:
Containment
Stop the spread quickly by isolating devices, blocking compromised accounts and cutting off attacker access.
Investigation
Work out what happened, how the attacker got in and which data or systems were affected.
Recovery
Restore systems and data from clean backups, reset access and confirm everything is working safely.
Reporting support
Help gathering the information needed for the ACSC, the OAIC, insurers and affected customers.
Incident response plan
A short, practical plan with roles, contacts, decision points and step-by-step playbooks for common incidents.
Tabletop exercises
Walk your team through a realistic scenario so everyone knows their role before a real incident happens.
How we work
Our process
Contain
Limit the damage and stop the attacker’s access.
Investigate
Find the cause and the scope of the incident.
Recover
Restore systems safely and get the business running.
Learn
Fix the root cause and update your plan.
Why Zenvia
Why choose Zenvia for incident response?
We combine hands-on recovery with planning, so the lessons from each incident make your business stronger. Where specialist forensics or legal advice is needed, we help you bring in the right people and work alongside them.
- A calm, structured response under pressure
- Recovery built around tested backups
- Help with reporting obligations
- Plans and playbooks your team can follow
- Root causes fixed, not just symptoms
FAQs
Frequently asked questions
What should we do first if we think we’ve been hacked?
Don’t turn devices off or delete anything. Disconnect affected devices from the network, change passwords from a clean device if you can, and contact us straight away. You can also report the incident to the ACSC through cyber.gov.au or by calling 1300 CYBER1.
Should we pay a ransom?
The Australian Government advises against paying. Payment doesn’t guarantee your data will be returned or deleted. Businesses with annual turnover above $3 million must also report any ransomware payment to the Australian Signals Directorate within 72 hours.
Do you offer digital forensics?
We investigate the cause and scope of most common incidents. If a formal forensic investigation is needed, for example for legal or insurance purposes, we’ll help you engage a specialist and support their work.
Can you help if we’re not an existing client?
Contact us and we’ll quickly let you know whether we can help. Clients with an agreed incident response arrangement get priority, with response times set out in their service agreement.
Related services
You might also need
Security Monitoring
Alerts for suspicious sign-ins, malware and unusual activity across Microsoft 365, computers and servers.
Backup & Recovery
Monitored backups for Microsoft 365, computers and servers, with recovery that is planned and tested.
Privacy & Data Breach Readiness
Map the personal information you hold, protect it and prepare a data breach response plan.
Ready to get started?
Don’t wait for an incident to find out what’s missing. Let’s build a response plan together.