Incident Response
Our team operates 24/7. With an IR retainer the response time is guaranteed in the contract; without one we take on active incidents as capacity allows. Containment, forensics, eradication, recovery. You minimise financial losses, preserve evidence, and return to operations faster.
Describe your scope — your account manager will reply within 24 hours.
- Free quote
What is Incident Response?
Incident Response is a structured process for rapidly detecting, analyzing, and neutralizing cyberattacks to minimize damage and restore normal operations. nFlo's IR team operates 24/7 — clients on an IR retainer get a response time guaranteed in the contract — performing containment, forensics, threat eradication, and recovery.
Contact your account manager
Discuss Incident Response with your dedicated account manager.
During an attack, every minute costs thousands in losses
Team ready for action - available 24/7
Containment
Threat isolation in minutes not hours
Forensics
Forensic analysis with evidence preservation
Recovery
Safe return to operations
Ransomware over the weekend — why response procedures matter
Without Incident Response procedures:
- Chaos and panic - no one knows what to do first
- Evidence loss due to unskilled actions
- Extended downtime (ransomware outages often last weeks)
- No report for insurer = claim denial
- Non-compliance with NIS2 requirements (mandatory incident reporting within 24h)
Professional Response from Minute One
We don’t experiment on your production systems. Our team has experience in hundreds of incidents - from ransomware through APT to insider threats. We operate according to proven playbooks, preserve evidence, and document every step.
What you get:
- Immediate 24/7/365 response (phone, email, dedicated channel)
- Triage and situation assessment within the first hour
- Containment - threat isolation without destroying evidence
- Forensic analysis (digital forensics) maintaining chain of custody
- Attack vector identification, timeline, and compromise scope
- Safe threat eradication (malware, backdoors, accounts)
- Recovery support - system restoration and verification
- Final report for management, authorities (CSIRT, law enforcement), and insurer
- Preventive recommendations (lessons learned)
Who Is It For?
This service is for you if:
- You have an active incident NOW (ransomware, intrusions, data breach)
- You’re subject to NIS2 and need incident reporting procedures
- You want an IR retainer - guaranteed response time
- You have cyber insurance and want to meet its requirements
- You need forensic analysis after an incident (for court, regulator)
When Do You Need Incident Response?
Attacks and Intrusions
- Ransomware - encrypted files, ransom demand
- System intrusions - unauthorized access, backdoors
- Malware and viruses - infections, botnet, cryptominers
- Successful phishing - compromised accounts, fraud
- DDoS attack - service unavailability
Data Breaches
- Personal data leak - mandatory GDPR notification within 72h
- Intellectual property theft - know-how loss
- Account compromise - hijacked admin accounts, VIP email
- Data exfiltration - suspected leak to competitors
Suspicious Activities
- Unusual network traffic - C2 communication, suspicious connections
- Log anomalies - unknown logins, unusual hours
- Security system alerts - EDR, SIEM, IDS/IPS
- Employee report - suspicious emails, files, behavior
Engagement Models
Ad-Hoc Incident Response
One-time assistance with an active incident:
- Payment for actual hours worked
- Rate: €120-190/h (depending on time and criticality)
- Response start: as team capacity allows
- For companies without IR retainer
When: You have an incident NOW and can’t wait
Incident Response Retainer
Subscription ensuring team readiness:
- Guaranteed response time (agreed in the contract)
- Preferential hourly rates
- Hour package included in subscription
- Regular exercises and procedure tests (tabletop exercises)
- Playbook preparation for typical scenarios
- 24/7 hotline available
Price: from €1,900/month | For: Companies with NIS2 requirements, critical sectors
IR Procedure Development
Building incident response readiness:
- Procedure and playbook development
- Role and responsibility definition (RACI)
- Tool configuration (SIEM, EDR, communication)
- IT team training
- Tabletop exercises and incident simulations
- Cyber insurer integration
Time: 4-8 weeks | Price from: €14,000
Related Glossary Terms
Learn more about key concepts related to this service:
How we work
Our proven service delivery process.
Triage
Situation assessment and action prioritization (0-1h)
Containment
Threat isolation and evidence preservation (1-4h)
Investigation
Forensic analysis and attack timeline (4-72h)
Eradication
Threat removal and vulnerability closure (72h+)
Recovery
System restoration and final report
Benefits for your business
What you gain by choosing this service.
Loss Minimization
Every saved hour means hundreds of thousands saved
Evidence Preservation
Professional forensic analysis for court
Insurer Support
Report for cyber damage claims
NIS2 Compliance
Meet IR procedure and reporting requirements
Related Articles
Expand your knowledge with our resources.
DDoS recommendation for ISPs no. 2026/67a/5: what it means for companies that are not internet providers
The Polish Government Plenipotentiary for Cybersecurity has updated the recommendation on protecting internet providers against DDoS. It is addressed to ISPs, but a company stops working when an attack hits its link or its provider. We translate the 15 points into questions for the ISP and actions on the company side.
Read more →How to detect layer 7 DDoS attacks? Signals, thresholds and TLS fingerprints
A layer 7 attack can take down an online shop or a customer portal while the link is almost empty. We describe six signals that reveal it and show how to combine them into a detection plan that does not block your customers.
Read more →Adversarial Exposure Validation (AEV): BAS vs automated pentesting vs CTEM
A year-old pentest report and thousands of scanner findings do not answer the board's question: would we stop an attack today? The Adversarial Exposure Validation category addresses that gap — here is how it differs from BAS, automated pentesting and CTEM.
Read more →Frequently Asked Questions
Common questions about Incident Response.
How much does help with a ransomware incident cost?
Cost depends on complexity. Typical ransomware incident requires 40-120 hours of work (forensics, eradication, recovery). Cost: €5,000 - €25,000. For comparison: ransom demands are high, and downtime can cost millions.
How quickly do you respond to an incident?
For IR retainer clients: within the response time agreed in the contract (SLA). Without a retainer: as team capacity allows. In critical situations (active ransomware) - immediately. We operate 24/7/365.
Will you help recover encrypted files?
We help with safe recovery from backups and securing against repeat attacks. File decryption without the key is often impossible. As a last resort, we support negotiations with attackers.
Will you report the incident to authorities for us?
We'll prepare the report with technical information and attack timeline. Formally, the Data Controller (your company) submits it. For NIS2, we'll help report to CSIRT within the required 24h timeframe.
What's the difference between IR retainer and ad-hoc help?
IR retainer is a subscription with a response time guaranteed in the contract, preferential rates, and an hour package. Ad-hoc is one-time help taken on as capacity allows, at a €120-190/h rate. We recommend retainer for companies with NIS2 requirements.