Incident Response for South African Businesses

Under attack? We help you contain, investigate, and recover.

Every minute of delay costs more. We contain the breach, find out how it happened, and get you back to work.

WhatsApp us now (urgent) Call +27 79 159 5040

Our response

Three phases. One goal. Back to work.

From the call to back online, we run the same playbook every time.

01

Phase one, contain (hours)

Stop the bleeding. We guide your team through isolation live. Remote support starts immediately, on-site in KZN if needed.

02

Phase two, investigate (1 to 3 days)

How did they get in? What did they touch? Any backdoors left behind? Forensic investigation gives you hard answers, not guesses.

03

Phase three, recover and harden

Remove malware and attacker access, close the holes they used, restore from clean backups. If POPIA notification is triggered, we guide that too.

What you get

A full response, not just first aid

We do not patch and leave. The job ends when you have answers, evidence, and a hardened business.

Rapid containment

Stop the spread inside hours. Live guidance from a real human, plus remote tools to lock things down while you coordinate staff.

Breach mitigation and forensic reporting

We contain the damage, remove the attacker's access, and hand you a written timeline formatted for insurance or legal use.

Data recovery and backup restoration

We identify the ransomware variant, check for a known decryption path, and restore from clean backups. We advise against paying ransoms; technical recovery is always tried first.

POPIA notification guidance

If personal data was touched, we walk you through POPIA obligations: what to report, to whom, by when, and how to word it.

The cost of waiting

Why speed actually changes the outcome

Every hour matters. The longer the breach runs, the more data moves and the bigger the recovery bill.

Critical
R2.2B

Lost to cybercrime in SA annually

Every uncontained hour adds more stolen data and more recovery cost. Speed is the cheapest defence on the table.

INTERPOL & University of Pretoria
R10M

Maximum POPIA fine for breach failures

Failing to notify the Information Regulator after a breach can result in fines up to R10 million under POPIA.

POPIA, Section 107

Common questions

Incident response FAQ

01 What should I do right after a cyberattack?

Disconnect affected devices from your network. Do not power them off, that destroys forensic evidence. Photograph ransom notes and strange alerts. Then WhatsApp or call us immediately. Do not try to fix it yourself first.

02 How fast can you respond?

Remote assistance starts immediately via WhatsApp or secure video call. First contact inside 2 to 4 hours during business hours. On-site response available in KZN for urgent cases.

03 Do I have to report a breach to regulators?

Under POPIA, if the breach touches personal information and creates a real risk of harm, you must notify the Information Regulator and the affected people as soon as reasonably possible. We guide that process as part of the response.

04 Can you recover ransomware files?

We identify the ransomware variant and check for a known decryption tool. We assist with recovery from clean backups. We strongly advise against paying ransoms, technical recovery is always tried first.

Contact us

Report an incident or set up a retainer

Under attack right now? WhatsApp first, it is the fastest. Use the form for retainers or proactive response planning.

Address

21 Lighthouse Road, uMhlanga, KZN

Report an incident or enquire