When Every Minute Matters,Regain Control.

Avoid making large changes before the situation is understood. Write down what was observed and when, don't delete suspicious emails, files, or logs, and limit use of systems that appear affected. Contact your IT or security provider as early as possible and notify internal leadership according to your policies. If you carry cyber insurance, review your policy early, since many insurers have specific notification requirements. The right first steps depend on what is happening in your environment, so it helps to talk through the situation before taking broad action.

Isolating an affected device can help limit spread, but how it's done matters. Disconnecting network access, such as unplugging the network cable or turning off Wi-Fi, is generally preferable to powering a device off, because shutting down can erase information in memory that may help an investigation. In some environments, isolating a system can also disrupt critical operations. If you're unsure, contact OneGuard IT to discuss the situation before disconnecting systems broadly.

Yes. OneGuard IT helps organizations respond to ransomware by assessing the scope of the event, helping contain further spread, and evaluating recovery options such as restoring from available backups. Outcomes depend on factors like the condition of backups, the extent of the encryption, and the environment itself, so we can't guarantee that every system or file can be recovered. Decisions about ransom demands involve legal, insurance, and regulatory considerations and should be made with your legal counsel and insurance provider.

We work to identify how an incident likely began and progressed by reviewing available evidence such as logs, endpoint data, account activity, and system configurations. How conclusive that analysis can be depends on what evidence exists and how well it was preserved. Sometimes the initial access point can be identified with confidence; other times findings are limited to the most likely explanation. When specialized digital forensics is needed, additional forensic specialists may need to be involved.

Yes. Recovery support may include restoring systems from available backups, rebuilding affected devices, resetting credentials, validating that restored systems work correctly, and monitoring for signs of continued compromise. What can be recovered depends on the condition of backups and the nature of the incident, so recovery is planned carefully and prioritized around your most critical operations.

It may be appropriate, depending on the nature of the incident. In the United States, organizations often report cyber incidents to agencies such as the FBI, including through its Internet Crime Complaint Center (IC3), or to CISA. Whether and when to contact law enforcement is a decision best made with your legal counsel. OneGuard IT does not provide legal advice, but we can help document technical information that may be useful to your counsel and to investigators.

We can coordinate with your insurance provider and the parties they involve, and help supply technical information about the incident when requested. Policies vary, and some require specific vendors, notification steps, or approvals before response work begins. We recommend contacting your insurer early and reviewing your policy with your broker or legal counsel. OneGuard IT can't interpret your coverage or guarantee that any cost will be covered.

When possible, preserve anything that could help explain what happened: suspicious emails, ransom notes or on-screen messages (photos are helpful), system and security logs, a list of affected devices and accounts, and notes on what was observed, when, and by whom. Avoid wiping, reimaging, or restoring affected systems until evidence preservation has been discussed with your response team. Your legal counsel can advise whether specific preservation or notification obligations apply to your organization.

Yes. After an incident, OneGuard IT can help prioritize improvements based on what was learned, such as strengthening identity and access controls, endpoint protection, network segmentation, backups, logging, and monitoring. Organizations that want a deeper evaluation can also engage Alpha Group, OneGuard IT's offensive security division, for an authorized security assessment. No set of controls eliminates risk entirely, but targeted improvements can reduce the likelihood and impact of future incidents.