Incident response in Belgium
An attack is in progress, or you suspect one. I help you stop it, understand what happened and get back to business, with a GSE-certified responder who stays reachable from the first call to the final report.
When to call
- Files are encrypted, or a ransom note appears on your screens
- A Microsoft 365 account sends phishing, or suspicious sign-ins appear
- Your EDR or SOC raises an alert you can't qualify
- An attacker claims to hold your data, or it shows up online
- Servers or accounts behave strangely and nobody knows why
How I work
- 01
First call and triage
We assess the situation together: what's affected, how urgent it is, and which measures to take immediately.
- 02
Containment
Stop the spread: isolate systems, cut the attacker's access, and preserve the evidence before it disappears.
- 03
Investigation
Find the initial access, the scope of the compromise and a timeline of the attacker's actions, with tools such as Velociraptor.
- 04
Eradication and recovery
Remove the attacker's persistence, close the entry point and restore your systems in the right order.
- 05
Report and lessons learned
A clear report and a debrief, so the same attack doesn't work twice.
What you get
- A timeline of the incident, from initial access to containment
- The root cause and the list of affected systems and accounts
- Prioritised actions, from quick fixes to long-term improvements
- An executive summary for your management and, if needed, your cyber insurer
See an excerpt of a sample incident response reportPDF, 3 pages, in English. Fictitious, anonymised scenario. Request the full 30-page report
Why Cyber Horizon
- GIAC Security Expert (GSE #433), one of the most demanding certifications in the field
- Years of hands-on incident response experience, including large-scale ransomware attacks
- Experience in defence and financial-sector incident response teams
- You work directly with me: no call centre, no hand-off to a junior
Incident response retainer
Don't wait for the attack to look for help. With a retainer, everything is agreed in advance: when an incident hits, you call, and we start right away.
Discuss a retainer- Contract and contacts in place before the incident: no negotiation in the middle of a crisis
- Priority handling and a response time agreed together
- Pre-paid hours, usable for an incident or, if all stays quiet, for preparation: playbooks, log review, tabletop exercises
- An annual check-in on your readiness
Frequently asked questions
How quickly can you respond?
Within 24 hours for an incident in progress. The first call is used to qualify the situation and agree on the immediate measures.
Should we pay the ransom?
That decision belongs to your management and legal advisers. I give you the facts to decide: what the attacker really has, what can be restored, and what is known about the group. See ransomware support.
Can you work with our IT provider or our insurer?
Yes. Incident response is teamwork: I coordinate with your IT team, your providers and, if needed, your cyber insurer, and the report can be shared with them.
What do you need from us?
A contact person, access to your logs, EDR and admin consoles, and a list of your critical systems. We'll work out the rest together during the first call.
What is the difference with digital forensics?
Incident response manages the crisis: containment, coordination, recovery. Digital forensics is the in-depth, evidence-based investigation. It supports the response, and can also be requested on its own, after the fact.