Do not shut down affected machines — RAM holds evidence.
Isolate from the network without stopping the system.
Do not pay and do not communicate with the attackers.
Preserve logs before they are overwritten.
Document the time and nature of each finding.
Our response
Intake and qualificationContainmentForensic investigationEradication and restorationPost-incident reportSupport with regulatory notification obligations