An incident right now? Call us: +49 2058 175 566 0
See the first stepsOnce it has happened, every hour counts.
We take the first steps and secure evidence that holds up in court. We bring your operations back in an orderly way. And we prepare your reports under NIS2, DORA and GDPR. Best settled before you need it.
The first hours decide it
The four mistakes we see most often — all of them avoidable in advance.
Pulling the plug destroys evidence
The first reflex is to take everything off the network. That wipes the memory. And with it, often the only clue to how the attackers got in and what they took.
Notification deadlines start at the point of awareness
Under NIS2 and the GDPR, the clock starts when you learn of the incident. Not when you have understood it. If you start taking notes two days in, half the time is already gone.
The contact chain is missing when it matters
Who decides to halt production? Who speaks to customers, who to the insurer? Without roles named in advance, the most expensive delays are not technical but organisational.
Recovery leads straight back into the same gap
Systems are restored from backup before the root cause is understood. The attackers are then often still inside — or come back in the same way.
What we take on when it counts
From the first report to the final one. We handle the technology, the organisation and the rules.
Emergency hotline
One number where an experienced expert picks up and works through the first steps with you. No ticket that lands in a queue.
Forensics
We secure traces on PCs, servers and in the cloud. We rebuild what happened when and how the attackers worked. Every piece of evidence stays traceable without gaps.
Containment
We lock affected accounts, end sessions and revoke access. We also close the hidden back doors attackers leave behind. All of it fits your operations, so the response does not do more harm than the attack.
Notifications under NIS2 and DORA
We prepare the content of the first, interim and final reports. We supply the technical evidence and record the timeline so anyone can follow it.
Recovery
A clear recovery plan that fixes the root cause first. Rather than a quick return to the very setup that was attacked.
Lessons learned
After the incident, we hold a workshop. We sum up the findings so management can act on them. They turn into concrete measures.
The phases of an incident
Six steps that build on one another in this order — shortcuts come back to bite later.
Preparation
Settle roles, notification lines and access before anything happens.
Detection
Confirm the incident, bound its scope, preserve volatile traces.
Containment
Stop the spread without destroying evidence.
Eradication
Remove the attackers’ access, back doors and tools completely.
Recovery
A controlled return to normal operations — with the root cause closed.
Follow-up
Final report, notifications, lessons learned, plan of measures.
Notification duties at a glance
The clock starts when you become aware — not when everything is understood.
| Legal basis | Deadlines |
|---|---|
| NIS2, Article 23 | Early warning within 24 hours, notification within 72 hours, final report within one month |
| GDPR, Article 33 | Notification to the supervisory authority within 72 hours of becoming aware |
| GDPR, Article 34 | Notification of data subjects without undue delay where the risk is high |
| DORA | Staged reporting of major ICT-related incidents to the competent authority |
Which duties apply to you depends on sector, size and the nature of the incident. We work that out with you during the engagement — the legal assessment stays with your legal advisers.
With a retainer or without
We help either way. The difference is what the engagement starts with.
| With a retainer | Without | |
|---|---|---|
| Response time | Contractually assured | Subject to current capacity |
| Contracts and confidentiality | Settled in advance | Negotiated during the incident |
| Knowledge of your environment | Recorded in advance, emergency procedures agreed | First survey while the incident is running |
| Day rates during an engagement | Reduced | Standard |
| Exercises | Practice drills for an emergency included | Commissioned separately |
Typical incidents
Three examples from practice — covered in more depth on the emergency page.
Ransomware
Encrypted file servers, halted production, a ransom note. We isolate systems and secure traces. We weigh up with you whether to pay. Then we restore the most important things first.
Compromised mailboxes
Hidden forwarding rules, fake payment requests, access through stolen logins. We check where your mail goes, lock down sign-in and protect your payment process.
Data exfiltration
Data leaks out through cloud storage, USB sticks or interfaces. We work out which data is affected, how much and how sensitive. And we prepare the report to the supervisory authority.
What you get
- A final report that holds up with authorities and insurers
- A reconstructed timeline of the attack
- A list of traces that help you spot the attack yourself
- Drafts for communication with authorities, customers and employees
- A prioritised plan of measures with an effort estimate
- A lessons-learned workshop with everyone involved
Frequently asked questions
- We have an incident right now — what should we do?
- Call us: +49 2058 175 566 0. Do not pull affected systems off the network in a hurry, or volatile traces in memory are lost. Instead, write down what you can see and who did what and when. We will work through everything else with you on the phone.
- What is a retainer worth if we have never had an incident?
- It saves you the start-up time when it counts. Contracts, the non-disclosure agreement and access rules are settled in advance. We already know your setup. And the response time is fixed in the contract. Without a retainer, every engagement starts with contract talks and a first survey. That time is very costly during an incident.
- What does an engagement cost?
- The first call, including an initial assessment of the situation, is free. After that we work on day rates against an agreed time budget. Retainer clients pay reduced rates when an engagement starts. Terms on request.
- Who files the NIS2 or GDPR notification?
- You do, as the affected organisation. We prepare the content, the form and the timeline. We supply the technical evidence and draft the text with you. Filing it, and the responsibility for it, stays with you. That cannot be outsourced.
- Should we pay in a ransomware case?
- Check every other option first: backups, free decryption tools, legal advice and your insurer’s rules. Paying guarantees neither that you get your data back nor that the attackers stay quiet. It can also cause legal trouble, for example with sanctions or tax law. We assess the situation with you step by step. We do not take the decision off your hands.
- Do you work with our cyber insurer?
- Yes. Many policies require a set reporting chain and documented steps. Otherwise the payout is cut. From day one, we keep records in a form insurers accept. Where needed, we work directly with the loss adjuster.
- How do you secure evidence so it can be used later?
- We log every forensic step. We preserve evidence to recognised standards. A checksum (hash value) shows that nobody changed it. We record without gaps who had access and when. That way the final report holds up with authorities, insurers and, if it comes to it, in court.
In an emergency, the right number is worth its weight in gold.
Put a retainer in place before you need it — and hope you never do.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.