Passeca - Governance, Risk management, and Compliance support
Under attack?

Under attack? Contact our incident-response team now.

Active security incident only. Send us a short request and our team will get back to you as soon as possible — every minute counts.

Request urgent help
Incident Response

Under attack? We act now.

Active security incident? Contact our incident-response team — send us a short request and we will get back to you as soon as possible. Every minute counts.

Request urgent helpGet an IR retainer
Glowing orange laptop on volcanic rock showing servers, an alert and a flagged user account
Active incident

Request urgent help

Tell us who you are and how to reach you. Your request goes straight to our incident-response team. For anything that is not an active incident, use our contact page.

For active security incidents only. By clicking the button you agree to our Privacy Policy. Your request is sent straight to our incident-response team.

Incident-response operator wearing a headset in front of network, document and checklist panels

Passeca's Incident Response team handles active threats such as ransomware, account takeover, data breaches and intrusions — from containment through recovery and forensics to lessons learned.

For faster response when an incident occurs, an IR retainer gives you immediate access to our team and predictable costs. It also helps your organisation meet DORA and NIS2 requirements for incident response and preparedness.

Incident response workflow: contain, eradicate, recover, then forensics and lessons learned, with continuous monitoring, detection, response and resolution.

Active security incidents

  • Ransomware
  • Account takeover
  • Data breach
  • Intrusion

Passeca's

Incident-Response Team

Detects, contains and resolves incidents — and turns every incident into a stronger, more resilient security posture.

  1. Contain

    Stop the threat, isolate affected systems and limit further damage.

  2. Eradicate

    Remove the threat, close vulnerabilities and restore security controls.

  3. Recover

    Restore systems, data and operations safely and securely.

  4. Forensics & lessons learned

    Investigate the root cause, gather evidence and strengthen defences for the future.

The process

What happens in the first hour

The first sixty minutes decide how far an attack spreads. Here is what we do, from the moment you reach us.

  1. 01

    First hour — triage & containment

    We confirm the incident, assess the initial scope and start containment. We further isolate affected devices, disable compromised accounts and preserve evidence. The goal in the first hour is to stop the threat from spreading.

  2. 02

    Eradication

    Once the threat is contained, we remove the attacker’s access, malicious software and persistence mechanisms. We also fix the path the attacker used to prevent the same intrusion from happening again.

  3. 03

    Recovery

    We restore affected systems to a known-good state, verify each system is clean before we reconnect it and bring services back online in priority order agreed with your operations team.

  4. 04

    Forensics

    We determine the root cause, scope and timeline of the incident — what the attacker accessed, what data they exfiltrated and how they moved through your environment. These findings provide a clear record for regulators, insurers and, where relevant, law enforcement.

  5. 05

    Lessons learned

    We close the gap that allowed the incident and harden the environment against recurrence. From there, our specialists prioritise remediation, track it through to completion and provide an executive post-incident report.

  • Step 01 Triage: a laptop with a malware alert inside a containment ring
  • Step 02 Eradicate: an infected device isolated from surrounding systems
  • Step 03 Recover: a server stack with a restore arrow
  • Step 04 Forensics: a magnifier showing a fingerprint over evidence files
  • Step 05 Lessons: a glowing check mark on a platform
Be ready before you need it

The IR retainer

An Incident Response retainer means you have a response plan and a team ready before an incident occurs.

A retainer gives you pre-agreed response capacity, clear terms and predictable costs. Organisations choose a retainer for three main reasons:

  • Faster response. With the commercial and legal terms already agreed, our team can mobilise quickly — without a procurement process during an active incident.
  • Predictable cost. Rates are agreed in advance, so you know what to expect when you need urgent support.
  • Compliance readiness. A retainer can support incident-response preparedness under DORA and NIS2 and, for manufacturers in scope of the CRA, establish a defined response path for severe product-security incidents.

Retainer clients also receive readiness support, including playbook reviews, tabletop exercises and escalation-contact checks. When an incident occurs, your team and ours already know what to do.

IR retainer overview: an analyst at a console and three benefits — faster response, predictable cost, compliance
If it's ransomware

Related ransomware services

Ransomware protection (Halcyon)

Prevent ransomware attacks before they execute with Halcyon’s dedicated anti-ransomware protection.

Ransomware protection
FAQ

Incident response, answered

What should I do right now, while waiting for the response team?
Do not power off affected machines unless our team tells you to — this can destroy valuable evidence. If it is safe to do so, isolate affected systems from the network using your EDR or by disconnecting the network cable. Avoid discussing the incident through potentially compromised channels, and do not pay a ransom before speaking with our team. Then contact us through the urgent request form on this page.
How fast can Passeca respond?
For retainer clients, response begins immediately under a pre-negotiated contract. For non-retainer emergency engagements, the response team mobilises as fast as logistically possible once we receive your request.
What is an IR retainer?
An Incident Response retainer is a pre-negotiated agreement that gives you access to a defined response capacity at agreed rates. Because the commercial and legal terms are settled in advance, our team can mobilise faster and costs remain predictable. A retainer can also help organisations demonstrate the incident-response preparedness required by DORA and NIS2.
How much does Incident Response cost?
Emergency response is scoped to the incident and its complexity, so costs vary depending on the situation and the level of support required. An IR retainer gives you predictable annual costs, pre-agreed response rates and access to our team when you need it. This helps you avoid negotiating terms and costs in the middle of an active incident.
Do you handle ransomware incidents?

Yes. Passeca's Incident Response team handles ransomware containment, investigation, negotiation support and recovery. We also offer dedicated ransomware protection services.

Is an IR retainer a compliance requirement?
DORA and NIS2 do not specifically require organisations to have an Incident Response retainer. They do require covered organisations to maintain appropriate capabilities and processes for incident handling and response. An IR retainer can help demonstrate that capability and provide a defined response process when an incident occurs.
Will the response be confidential?
Yes. Passeca handles Incident Response under strict confidentiality and follows the controls of its ISO/IEC 27001:2022-certified information security management system.
Is incident response the same as a SOC?
No, incident response is not the same as a SOC. A SOC continuously monitors your environment, detects threats and investigates alerts. Incident Response focuses on serious security incidents that require containment, investigation, recovery and remediation. The two work together: the SOC detects and escalates incidents, while the Incident Response team takes action when an incident requires deeper response.
What are the key differences between managed Incident Response services and building an in-house team?
An in-house team gives you dedicated internal resources but requires the right people, expertise and 24/7 coverage. A managed Incident Response service gives you access to specialist responders when you need them, without the cost of maintaining a dedicated team. A retainer adds pre-agreed terms and response capacity before an incident occurs.
How does an Incident Response retainer complement a SOC?
A SOC provides continuous monitoring and detection, while an Incident Response team handles serious incidents that require containment, investigation and recovery. A retainer gives your organisation access to specialist responders when an incident goes beyond day-to-day security operations.
Which Incident Response approach suits financial services: SOC integration or a dedicated Incident Response retainer?
A SOC and an Incident Response retainer serve different purposes. A SOC provides continuous monitoring, detection and alert investigation, while an Incident Response retainer gives your organisation access to specialist responders for serious incidents that require containment, investigation and recovery. For financial services organisations, the two can work together: the SOC detects and escalates threats, while the Incident Response team handles incidents that require deeper response.
Can an Incident Response retainer by Passeca support Cyber Resilience Act reporting?
Yes. For manufacturers in scope of the CRA, an Incident Response retainer can provide rapid access to specialists who can investigate a severe product-security incident, establish scope and timeline, preserve evidence and support the information needed for regulatory reporting. The manufacturer remains responsible for determining whether an event is reportable and submitting the required notification.
How does Incident Response by Passeca support NIS2 incident reporting?
NIS2 requires covered organisations to report significant incidents on a defined timeline, beginning with an early warning within 24 hours and an incident notification within 72 hours. Incident Response by Passeca helps your team determine what happened, assess impact, contain the threat and gather the technical evidence needed to support that reporting process.
Always-on defence

Don't wait for the incident — prepare now.

An IR retainer turns a crisis into a plan. Pre-agree your response capacity, get immediate access to our specialists and strengthen your incident-response readiness for DORA and NIS2.

Get an IR retainerRequest urgent help

Related

Services hubAll four Passeca service familiesRansomware ProtectionPrevent ransomware with HalcyonSOC-as-a-ServiceContinuous monitoring that prevents incidentsBusiness Continuity & DRRecover and stay resilientContactOffices and contact routesBook a consultationArrange an IR retainer