THREAT-WATCHINCIDENT RESPONSE
Incident Response: When It’s Already Happening
Expert-led containment, investigation, and remediation, whether you're a retained client or reporting an active breach right now.
What you get
Incident response only works if it starts fast. We combine zero-trust containment technology with hands-on engineering to isolate the threat, investigate root cause, and get you back to operating, then document what happened for regulators, insurers, and your own post-incident review. On Gold and Platinum, every contract year renews with 15 hours of incident response work included at no extra cost, so responding fast never turns into an unplanned invoice. On Bronze and Silver, hands-on response is billed per hour at a rate agreed up front.
Immediate triage
We assess scope and severity first, so containment decisions are based on what's actually happening, not guesswork.
Zero-trust containment
Compromised systems are isolated using zero-trust ransomware containment technology to stop spread while investigation continues.
Root-cause investigation
We determine how the attacker got in and what they accessed, not just that something was detected.
Regulatory documentation
Incident timelines and evidence are documented in a form usable for NIS2 incident reporting and insurer or regulator inquiries.
15 free IR hours a year on Gold and Platinum
Gold and Platinum clients get 15 hours of incident response work included every year they stay with us, renewing annually under their Service Agreement at no additional cost.
How incident response runs
Every incident is different, but the order of work is not. These are the stages we follow, whether you are a client or reporting a breach for the first time.
Report and triage
Clients are covered by the 24/7 SOC and the contact channel their plan provides. If you are not a client, use the breach reporting form; outside office hours (Mon–Fri 10:00–18:00 Athens time) review is best-effort. We first establish what is affected, how badly and whether the attacker is still active.
Containment
We stop the spread before anything else: isolating hosts, disabling compromised accounts and blocking malicious connections, while preserving the evidence the investigation will need.
Investigation
We work out how the attacker got in, what they touched, which accounts and data were involved, and when each step happened. That timeline drives every decision that follows.
Eradication and recovery
We remove persistence, reset exposed credentials and close the entry point, then coordinate restoration from clean backups so you return to operation without bringing the attacker back with you.
Reporting and lessons learned
You receive a written account of the incident that you can use with your board, insurer and regulators. Every plan includes a post-incident call with the engineer who handled your case; from Gold up, our CEO joins that call.
What is covered, and what is not
Covered
- Triage, scoping and severity assessment
- Containment of affected systems and accounts
- Root-cause investigation and incident timeline
- Eradication guidance and recovery coordination
- Documentation for NIS2 reporting, insurers and regulators
- Post-incident call and hardening recommendations
Not covered
- Legal advice and filing regulatory reports in your name. We prepare the content; your organization files and remains accountable.
- Ransom negotiation. If it becomes relevant, we coordinate with specialist third parties.
- Court-grade digital forensics, which we arrange through vetted partners when a case calls for it.
- Public relations and customer communications, although we make sure the facts you communicate are accurate.
Incident response and NIS2 reporting
Incident handling is one of the ten Article 21 measures, and Article 23 sets the reporting clock for significant incidents: an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report within one month of the notification that covers severity, impact, likely root cause and the mitigation applied. The investigation work above produces exactly that content, and we draft it with you as the incident unfolds. If personal data is involved, GDPR’s separate 72-hour notification to the data protection authority may also apply. In every case, the obligation to report stays with your organization.
Incident response on each plan
Monitoring and containment are included on every plan. Gold and Platinum include 15 hours of hands-on incident response work every contract year. On Bronze and Silver, hands-on response is billed per hour at a rate agreed up front, so there are no surprises in the middle of an incident. Every plan includes a post-incident call with the engineer, and from Gold up our CEO joins it.
Compare plans →FAQ
We're not a client. Can you help with an active breach right now?
Yes. Use the breach reporting form or email info@threat-watch.com. We review every report as soon as possible; outside office hours (Mon–Fri 10:00–18:00 Athens time) this is best-effort. Existing clients are covered by our 24/7 SOC.
Do you offer a retainer for faster response?
Yes, retained clients get the response commitments written into their Service Agreement rather than starting from a cold engagement.
Do clients get any free incident response hours?
Yes, on Gold and Platinum. Those clients get 15 hours of incident response work included free each year they stay with us, renewing annually under the Service Agreement. On Bronze and Silver, monitoring and containment are still included, and hands-on response is billed per hour at a rate agreed up front.
Will you help us report to regulators?
We document the incident in a form that supports NIS2 and other regulatory reporting obligations, though the legal filing itself is your organization's responsibility.
What should we do in the first hour of an incident?
Disconnect affected machines from the network rather than switching them off, so evidence in memory is not lost. Do not wipe or reinstall anything yet, do not contact the attacker, and write down what you saw and when. Then report it to us, and check whether your cyber insurance policy requires early notification.
Should we turn infected computers off?
Usually not. Powering off destroys evidence held in memory that can show what the attacker did. Isolating the machine from the network stops the spread while keeping that evidence available.
Can you work with our cyber insurer?
Yes. We document incidents in a form insurers can use. Some policies require early notification or the use of the insurer’s approved responders, so check your policy terms and tell us; we can work alongside the insurer’s panel where needed.
Does incident response include getting us back up and running?
Yes, recovery coordination is part of it. Restoring from backups is faster and safer when backups are managed and tested in advance, which is why backup and disaster recovery is included from Silver up.
What happens after the incident is closed?
You get a written account of what happened and a post-incident call with the engineer who handled it, with our CEO joining from Gold up. We then close the path the attacker used and recommend changes so the same route does not work twice.
Active incident? Report it now.
If you're dealing with a breach right now, don't wait for a callback. Use the breach reporting form.