It usually happens at night or over a weekend. Systems slow, then stop. A text file appears on every server explaining that your data has been encrypted and copied, and that it will be published unless you pay. The people who first see that message often have no idea what to do, and the choices they make in the next hour can decide how bad the following month becomes.
What the training covers
We walk leaders and IT teams through the first hours of an attack in plain terms. How to contain it without destroying the evidence of how the attackers got in. Why switching everything off can make things worse. Who to call, in what order, including insurers, lawyers and specialist responders. How to communicate with staff when email may be compromised.
The regulatory clock
If personal data is affected, UK GDPR generally requires a notifiable breach to be reported to the Information Commissioner’s Office within 72 hours of becoming aware of it. Teams who have thought about that in advance make better, calmer decisions.
To pay or not to pay
Payment is never a simple decision. It may not restore your data, it can mark you as a target, and in some circumstances it can expose you to legal risk. We explain the considerations so leaders are prepared to take advice rather than react.
If an attack happens, our incident response team can help. To rehearse the whole thing, run a desktop scenario. Arrange a session.
