Incident Response
Our team operates 24/7. With an IR retainer the response time is guaranteed in the contract; without one we take on active incidents as capacity allows. Containment, forensics, eradication, recovery. You minimise financial losses, preserve evidence, and return to operations faster.
Describe your scope — your account manager will reply within 24 hours.
- Free quote
What is Incident Response?
Incident Response is a structured process for rapidly detecting, analyzing, and neutralizing cyberattacks to minimize damage and restore normal operations. nFlo's IR team operates 24/7 — clients on an IR retainer get a response time guaranteed in the contract — performing containment, forensics, threat eradication, and recovery.
Contact your account manager
Discuss Incident Response with your dedicated account manager.
During an attack, every minute costs thousands in losses
Team ready for action - available 24/7
Containment
Threat isolation in minutes not hours
Forensics
Forensic analysis with evidence preservation
Recovery
Safe return to operations
Ransomware over the weekend — why response procedures matter
Without Incident Response procedures:
- Chaos and panic - no one knows what to do first
- Evidence loss due to unskilled actions
- Extended downtime (ransomware outages often last weeks)
- No report for insurer = claim denial
- Non-compliance with NIS2 requirements (mandatory incident reporting within 24h)
Professional Response from Minute One
We don’t experiment on your production systems. Our team has experience in hundreds of incidents - from ransomware through APT to insider threats. We operate according to proven playbooks, preserve evidence, and document every step.
What you get:
- Immediate 24/7/365 response (phone, email, dedicated channel)
- Triage and situation assessment within the first hour
- Containment - threat isolation without destroying evidence
- Forensic analysis (digital forensics) maintaining chain of custody
- Attack vector identification, timeline, and compromise scope
- Safe threat eradication (malware, backdoors, accounts)
- Recovery support - system restoration and verification
- Final report for management, authorities (CSIRT, law enforcement), and insurer
- Preventive recommendations (lessons learned)
Who Is It For?
This service is for you if:
- You have an active incident NOW (ransomware, intrusions, data breach)
- You’re subject to NIS2 and need incident reporting procedures
- You want an IR retainer - guaranteed response time
- You have cyber insurance and want to meet its requirements
- You need forensic analysis after an incident (for court, regulator)
When Do You Need Incident Response?
Attacks and Intrusions
- Ransomware - encrypted files, ransom demand
- System intrusions - unauthorized access, backdoors
- Malware and viruses - infections, botnet, cryptominers
- Successful phishing - compromised accounts, fraud
- DDoS attack - service unavailability
Data Breaches
- Personal data leak - mandatory GDPR notification within 72h
- Intellectual property theft - know-how loss
- Account compromise - hijacked admin accounts, VIP email
- Data exfiltration - suspected leak to competitors
Suspicious Activities
- Unusual network traffic - C2 communication, suspicious connections
- Log anomalies - unknown logins, unusual hours
- Security system alerts - EDR, SIEM, IDS/IPS
- Employee report - suspicious emails, files, behavior
Engagement Models
Ad-Hoc Incident Response
One-time assistance with an active incident:
- Payment for actual hours worked
- Rate: €120-190/h (depending on time and criticality)
- Response start: as team capacity allows
- For companies without IR retainer
When: You have an incident NOW and can’t wait
Incident Response Retainer
Subscription ensuring team readiness:
- Guaranteed response time (agreed in the contract)
- Preferential hourly rates
- Hour package included in subscription
- Regular exercises and procedure tests (tabletop exercises)
- Playbook preparation for typical scenarios
- 24/7 hotline available
Price: from €1,900/month | For: Companies with NIS2 requirements, critical sectors
IR Procedure Development
Building incident response readiness:
- Procedure and playbook development
- Role and responsibility definition (RACI)
- Tool configuration (SIEM, EDR, communication)
- IT team training
- Tabletop exercises and incident simulations
- Cyber insurer integration
Time: 4-8 weeks | Price from: €14,000
Related Glossary Terms
Learn more about key concepts related to this service:
How we work
Our proven service delivery process.
Triage
Situation assessment and action prioritization (0-1h)
Containment
Threat isolation and evidence preservation (1-4h)
Investigation
Forensic analysis and attack timeline (4-72h)
Eradication
Threat removal and vulnerability closure (72h+)
Recovery
System restoration and final report
Benefits for your business
What you gain by choosing this service.
Loss Minimization
Every saved hour means hundreds of thousands saved
Evidence Preservation
Professional forensic analysis for court
Insurer Support
Report for cyber damage claims
NIS2 Compliance
Meet IR procedure and reporting requirements
Related Articles
Expand your knowledge with our resources.
Network traffic analysis with NetFlow and IPFIX flows: what you see, what you miss and how it supports NIS2
The firewall guards the perimeter, EDR guards devices with an agent. Traffic between servers, printers and cameras inside the network falls outside both. We show what can be detected from flows alone, when you need packet capture and what network data you need within 24 hours of detecting an incident.
Read more →Immutable backup for businesses: why immutability is a property of the whole arrangement, not of the medium
"We have immutable copies" sounds like the end of a ransomware conversation. It is usually the beginning, because an immutable medium without separated accounts and a separated recovery console protects against an administrator's mistake, not against an attacker who already is that administrator. We show where the line runs and how to verify it.
Read more →How much does ransomware cost a company? A bill in six line items
The attacker gives you exactly one number — the ransom. The other five line items you have to work out yourself, and every one of them can be estimated before anything happens. This text gives the formulas, names the person in your company who holds each figure, and marks the boundary where estimation stops working.
Read more →Frequently Asked Questions
Common questions about Incident Response.
How much does help with a ransomware incident cost?
Cost depends on complexity. Typical ransomware incident requires 40-120 hours of work (forensics, eradication, recovery). Cost: €5,000 - €25,000. For comparison: ransom demands are high, and downtime can cost millions.
How quickly do you respond to an incident?
For IR retainer clients: within the response time agreed in the contract (SLA). Without a retainer: as team capacity allows. In critical situations (active ransomware) - immediately. We operate 24/7/365.
Will you help recover encrypted files?
We help with safe recovery from backups and securing against repeat attacks. File decryption without the key is often impossible. As a last resort, we support negotiations with attackers.
Will you report the incident to authorities for us?
We'll prepare the report with technical information and attack timeline. Formally, the Data Controller (your company) submits it. For NIS2, we'll help report to CSIRT within the required 24h timeframe.
What's the difference between IR retainer and ad-hoc help?
IR retainer is a subscription with a response time guaranteed in the contract, preferential rates, and an hour package. Ad-hoc is one-time help taken on as capacity allows, at a €120-190/h rate. We recommend retainer for companies with NIS2 requirements.