Incident Response
Our team operates 24/7. With an IR retainer the response time is guaranteed in the contract; without one we take on active incidents as capacity allows. Containment, forensics, eradication, recovery. You minimise financial losses, preserve evidence, and return to operations faster.
What is Incident Response?
Incident Response is a structured process for rapidly detecting, analyzing, and neutralizing cyberattacks to minimize damage and restore normal operations. nFlo's IR team operates 24/7 — clients on an IR retainer get a response time guaranteed in the contract — performing containment, forensics, threat eradication, and recovery.
During an attack, every minute costs thousands in losses
Team ready for action - available 24/7
Containment
Threat isolation in minutes not hours
Forensics
Forensic analysis with evidence preservation
Recovery
Safe return to operations
Ransomware on Saturday - Company Lost 3 Weeks of Production
An automotive parts manufacturer was hit by ransomware on Saturday at 11:15 PM. IT noticed on Monday at 8:00 AM - 33 hours after the attack started. 90% of production systems and backups were encrypted. There was no IR procedure or contact for specialists. Downtime: 3 weeks. Cost: €2.8 million + lost contracts.
Without Incident Response procedures:
- Chaos and panic - no one knows what to do first
- Evidence loss due to unskilled actions
- Extended downtime (average 21 days for ransomware)
- No report for insurer = claim denial
- Non-compliance with NIS2 requirements (mandatory incident reporting within 24h)
Professional Response from Minute One
We don’t experiment on your production systems. Our team has experience in hundreds of incidents - from ransomware through APT to insider threats. We operate according to proven playbooks, preserve evidence, and document every step.
What you get:
- Immediate 24/7/365 response (phone, email, dedicated channel)
- Triage and situation assessment within the first hour
- Containment - threat isolation without destroying evidence
- Forensic analysis (digital forensics) maintaining chain of custody
- Attack vector identification, timeline, and compromise scope
- Safe threat eradication (malware, backdoors, accounts)
- Recovery support - system restoration and verification
- Final report for management, authorities (CSIRT, law enforcement), and insurer
- Preventive recommendations (lessons learned)
Who Is It For?
This service is for you if:
- You have an active incident NOW (ransomware, intrusions, data breach)
- You’re subject to NIS2 and need incident reporting procedures
- You want an IR retainer - guaranteed response time
- You have cyber insurance and want to meet its requirements
- You need forensic analysis after an incident (for court, regulator)
When Do You Need Incident Response?
Attacks and Intrusions
- Ransomware - encrypted files, ransom demand
- System intrusions - unauthorized access, backdoors
- Malware and viruses - infections, botnet, cryptominers
- Successful phishing - compromised accounts, fraud
- DDoS attack - service unavailability
Data Breaches
- Personal data leak - mandatory GDPR notification within 72h
- Intellectual property theft - know-how loss
- Account compromise - hijacked admin accounts, VIP email
- Data exfiltration - suspected leak to competitors
Suspicious Activities
- Unusual network traffic - C2 communication, suspicious connections
- Log anomalies - unknown logins, unusual hours
- Security system alerts - EDR, SIEM, IDS/IPS
- Employee report - suspicious emails, files, behavior
Engagement Models
Ad-Hoc Incident Response
One-time assistance with an active incident:
- Payment for actual hours worked
- Rate: €120-190/h (depending on time and criticality)
- Response start: up to 4 business hours
- For companies without IR retainer
When: You have an incident NOW and can’t wait
Incident Response Retainer
Subscription ensuring team readiness:
- Guaranteed response time (15-60 minutes)
- Preferential hourly rates
- Hour package included in subscription
- Regular exercises and procedure tests (tabletop exercises)
- Playbook preparation for typical scenarios
- 24/7 hotline available
Price: from €1,900/month | For: Companies with NIS2 requirements, critical sectors
IR Procedure Development
Building incident response readiness:
- Procedure and playbook development
- Role and responsibility definition (RACI)
- Tool configuration (SIEM, EDR, communication)
- IT team training
- Tabletop exercises and incident simulations
- Cyber insurer integration
Time: 4-8 weeks | Price from: €14,000
Related Glossary Terms
Learn more about key concepts related to this service:
Contact your account manager
Discuss Incident Response with your dedicated account manager.
How we work
Our proven service delivery process.
Triage
Situation assessment and action prioritization (0-1h)
Containment
Threat isolation and evidence preservation (1-4h)
Investigation
Forensic analysis and attack timeline (4-72h)
Eradication
Threat removal and vulnerability closure (72h+)
Recovery
System restoration and final report
Benefits for your business
What you gain by choosing this service.
Loss Minimization
Every saved hour means hundreds of thousands saved
Evidence Preservation
Professional forensic analysis for court
Insurer Support
Report for cyber damage claims
NIS2 Compliance
Meet IR procedure and reporting requirements
Related Articles
Expand your knowledge with our resources.
CVE-2026-81963 and CVE-2026-85880: Two Actively Exploited Windows Privilege Escalation Flaws
September's Patch Tuesday brought two privilege escalation flaws already being used in attacks. One affects new systems, the other old ones - together they cover practically the whole fleet...
Read more →CVE-2026-85046: Actively Exploited V8 Flaw in Google Chrome
Google has patched another V8 flaw - this one already used in attacks. A crafted HTML page allows code execution inside the browser sandbox. The fixed version is 152.0.7977.82...
Read more →CVE-2026-19117: authentication bypass via FIDO2 registration in Delinea Secret Server
Under specific conditions an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user — in a privileged access management system...
Read more →Frequently Asked Questions
Common questions about Incident Response.
How much does help with a ransomware incident cost?
Cost depends on complexity. Typical ransomware incident requires 40-120 hours of work (forensics, eradication, recovery). Cost: €5,000 - €25,000. For comparison: average ransom is €120,000, and downtime can cost millions.
How quickly do you respond to an incident?
For IR retainer clients: 15-60 minutes (depending on SLA). Without retainer: up to 4 business hours. In critical situations (active ransomware) - immediately. We operate 24/7/365.
Will you help recover encrypted files?
We help with safe recovery from backups and securing against repeat attacks. File decryption without the key is often impossible. As a last resort, we support negotiations with attackers.
Will you report the incident to authorities for us?
We'll prepare the report with technical information and attack timeline. Formally, the Data Controller (your company) submits it. For NIS2, we'll help report to CSIRT within the required 24h timeframe.
What's the difference between IR retainer and ad-hoc help?
IR retainer is a subscription guaranteeing 15-60 min response time, preferential rates, and hour package. Ad-hoc is one-time help with up to 4h business start time and €120-190/h rate. We recommend retainer for companies with NIS2 requirements.