Post-incident recovery and protection
After an attack: recover cleanly and reduce the chance it happens again.
Post-incident recovery and protection is the work that follows containment: restoring operations from clean sources, closing the way the attacker got in and adding the monitoring and controls that make a repeat less likely. ACS Cyber helps organizations do this whether we handled the response or another team did. If the attacker may still have access, call our 24/7 incident line at 1-650-300-7557 first.
01
Confirm containment
Make sure the attacker’s access has been removed before anything is restored. If you are not sure, call us before you go further.
02
Restore from clean sources
Use backups that predate the attacker’s access and are free of their tools, and rebuild systems that cannot be trusted.
03
Reset and review access
Reset passwords, revoke sessions and rotate keys for affected, admin and service accounts, then review who can reach what.
04
Close the root cause
Fix the way in that the investigation found, such as a phishing route, exposed remote access, a missing patch or a weak sign-in policy.
05
Watch as systems return
Monitor closely while systems come back online. Attackers sometimes try to return using what they learned.
- Systems still down after containment
- Restored, but unsure the attacker is gone
- Rebuilding after ransomware
- Insurer asking what has changed
- Leadership asking how to prevent a repeat
Not a client yet? You can still call. If another firm handled the response, we can start from their findings.
In plain terms
What post-incident protection is, and who it is for
Post-incident recovery means restoring systems, accounts and data in a controlled order, from sources you can trust. Post-incident hardening means closing the weaknesses the attacker used and adding the monitoring and controls that make the next attack harder to carry out and easier to catch early.
It is for organizations that have contained a ransomware attack, Business Email Compromise, an account takeover or a data exposure, whether ACS Cyber handled the response or someone else did, and now need to restore operations and strengthen security.
ACS Cyber is the managed security services provider (MSSP) and cybersecurity division of Atlantic Computer Systems, with an in-house 24/7 SOC. The team that helps you recover can also monitor and protect you afterward. Learn more about our incident response and DFIR services.
Not finished with the incident yet?
If the attacker may still have access, containment comes first. Call our 24/7 incident line or see active incident support.
If you still need to know how they got in and what they reached, start with an incident investigation.
Controlled recovery
Recover in a controlled order, from clean sources
Restoring too early can bring the attackers back. We help you validate that backups are intact and predate the attacker’s access, agree recovery priorities with leadership based on what the business needs first, and check each system before it returns to use.
Systems that cannot be trusted are rebuilt rather than cleaned. Clean rebuilds of servers, endpoints, Microsoft 365 and networks can be carried out by Atlantic Computer Systems, our parent company, which also provides managed cloud and backup services.
If you have an internal IT team or provider, we work alongside them with agreed roles. If you have no IT team of your own, Atlantic Computer Systems also offers fractional IT services that can take over day-to-day IT once recovery is complete.
- Recovery priorities agreed with leadership
- Backups validated before anything is restored
- Untrusted systems rebuilt from clean sources
- Each system checked before it returns to use
Before you call it finished
Close the gaps the attacker used
Recovery is not complete while the attacker could still walk back in. These steps run alongside the restore.
01
Reset credentials and review access
Passwords, sessions, MFA methods, keys and service accounts are reset or rotated, and access is reviewed so people and systems keep only what they need.
02
Close the root cause
The way in that the investigation found is fixed first, whether a phishing route, exposed remote access, an unpatched system or a weak sign-in policy.
03
Remove what was left behind
New accounts, remote-access tools, scheduled tasks, inbox rules and app consents the attacker added are found and removed.
04
Monitor while systems return
Sign-ins, endpoints and email are watched closely as systems come back, for signs that the attacker is trying to return.
Ongoing protection
Protection that continues after recovery
These services carry the lessons from the incident forward, so the next threat is more likely to be found and handled early.
24/7 managed detection and response
Our in-house SOC analysts monitor endpoints, identity, email, cloud and network 24/7 and take pre-approved containment actions under rules agreed with you in advance. Typical onboarding takes 2-4 weeks.
ACS-managed EDR
ACS supplies and manages the endpoint detection and response agent on your devices, and our SOC investigates what it sees.
Security awareness training
Phishing simulations and short, practical lessons on the ways attacks reach your people, such as phishing, payment fraud and impersonation.
Vulnerability management and penetration testing
Regular scanning, prioritized remediation and in-house penetration testing to confirm your fixes hold.
Microsoft 365 hardening
MFA, conditional access, mailbox protections and admin controls that close common routes into email accounts.
A monthly report, reviewed with you
Each month we review activity, investigations and open recommendations with you, so leadership can see progress.
Advisory and readiness
A roadmap, a practiced plan and renewal readiness
An incident shows where the gaps were. A vCISO turns the findings into a prioritized roadmap that leadership can fund and track. See our cybersecurity advisory and vCISO services. Atlantic Computer Systems, our parent company, also offers vCISO leadership as part of a fractional cybersecurity team.
We update your incident-response plan with what this incident taught you and run tabletop exercises with leadership, so the next set of decisions is made before the next incident.
After a claim, your carrier may ask more detailed questions at renewal about controls such as MFA, endpoint detection, backups and monitoring. We help you answer accurately and close the control gaps that come up. For a broader overview, Atlantic Computer Systems also summarizes the cyber insurance requirements carriers commonly ask about at renewal.
What the roadmap usually covers
- Fixes from the investigation, in priority order
- Identity, email and endpoint hardening
- Backup and recovery testing
- Monitoring and response coverage
- Policies, training and tabletop exercises
- The controls your insurer asks about
The path
From incident to a stronger program
Steps often overlap, and you can start wherever you are. If another firm handled containment or the investigation, we start from their findings.
01
Contain
The attacker’s access is cut off, by our team, your IT team or another response firm.
02
Investigate
How they got in, what they reached and what to fix are established, with evidence preserved under documented chain of custody.
03
Recover
Systems, accounts and data return in a controlled order, from validated backups or clean rebuilds.
04
Harden
Credentials are reset, access is reviewed, the root cause is closed and the most important gaps are fixed first.
05
Monitor
24/7 managed detection and response from our in-house SOC watches for the attacker’s return and for the next threat.
06
Improve
Monthly reviews, training, testing, a vCISO roadmap and tabletop exercises keep the program moving forward.
FAQ
Questions about recovery and protection after an attack
Confirm the attacker’s access is gone, restore from clean sources in a controlled order, reset credentials, close the way in and monitor closely as systems return. Then put lasting protection in place, such as 24/7 monitoring, staff training and regular testing. ACS Cyber helps with each step. Our 24/7 incident line is 1-650-300-7557.
Fix the way the attackers got in first, then add layers that make the next attempt harder and easier to catch early: MFA everywhere, monitored endpoints, immutable backups with tested restores, prompt patching and awareness training. No single control prevents every attack.
ACS Cyber provides 24/7 managed detection and response from our in-house SOC, with pre-approved containment actions. If it happens again, see our ransomware response page for first steps.
Only once the attacker’s access has been removed and the backups have been checked. Backups may have been reached or altered, and a restore can bring back the attackers’ tools or the weakness they used. We help you confirm which copies predate the attacker’s access, then restore in a controlled order.
Atlantic Computer Systems, our parent company, provides managed IT, so clean rebuilds of servers, endpoints, Microsoft 365 and networks can be carried out by the same organization that runs our SOC. If you have an internal IT team or an IT provider, we work alongside them with agreed roles.
Most deployments complete in 2-4 weeks, depending on the size and complexity of your environment. Onboarding covers scoping, deploying the EDR agent that ACS supplies and manages, and connecting sources such as Microsoft 365, Google Workspace, Azure, AWS, firewalls and servers. While systems are coming back, we can monitor closely for signs that the attacker is trying to return.
Carriers commonly ask about MFA, endpoint detection and response, backups, patching, security awareness training and incident-response planning, and after a claim they may ask what has changed. We help you answer accurately and close the gaps. We do not sell insurance. Our cyber-insurance readiness guide covers the controls underwriters commonly look at.
Yes. You do not need to be a client, and we can start from the other firm’s findings. If questions remain about how the attackers got in or what they reached, a forensic investigation can answer them before you rebuild.
Recovery and protection
Ready to recover and move forward?
If the incident is contained and you want to plan recovery and protection, book a free 30-minute consultation. If the attacker may still be active, call 1-650-300-7557. For other incidents, see how we help after any compromise.