Security services · Response

Incident response, any hour.

When something goes wrong, the first hours decide how bad it gets. Our responders help you contain the attack, remove the intruder, recover your systems and meet your reporting duties, while you keep running the business.

Set up a retainer Call the 24/7 line
24/7 incident lineRemote triage first, on site if neededCERT-In and DPDP reporting support
incident · sample● demo
  1. FOUND Ransom note on 40 file shares
  2. BLOCKED Attacker’s remote access cut off
  3. FLAGGED Clean backup found from Tuesday
  4. FIXED All admin passwords reset
  5. PASSED CERT-In report filed within 6 hours
In plain words

Incident response is the expert help you call when a cyber attack is under way or has just happened: ransomware, a hacked email account, stolen data or an intruder in your network. We work out what happened, stop it spreading, remove the attacker and restore clean systems, and give you the facts you need for CERT-In, the Data Protection Board, regulators, insurers and customers. With a retainer, the paperwork is done before you need us.

Availability
24/7 incident line
Approach
NIST SP 800-61 Rev. 3
Retainer
Terms and hours agreed in advance
Pricing
Retainer or per incident
The clock starts when you notice

Your first 72 hours.

Indian rules put hard deadlines on the first days of an incident. Knowing them before an attack is half the battle.

Incident reporting clock in India. Report the incident to CERT-In within 6 hours of noticing it. From 13 May 2027, if personal data is affected, tell the Data Protection Board and each affected person without delay, and send the Board a detailed report within 72 hours. Meanwhile responders triage, contain, investigate and recover. YOUR DUTIES IN INDIA CERT-IN 6 h · report the incident to CERT-In DPDP · FROM 13 MAY 2027 Without delay · tell the Board and each person affected DPDP · DETAILED REPORT 72 h · full report to the Board 0 h · you notice6 h24 h48 h72 h OUR RESPONDERS, IN PARALLEL 1 · TRIAGE2 · CONTAIN3 · INVESTIGATE4 · RECOVER
Deadlines from the CERT-In Directions of 28 April 2022 and Rule 7 of the DPDP Rules 2025, which applies from 13 May 2027. Sector regulators such as RBI, SEBI and IRDAI, and your cyber insurer, may set their own. The first six hours are stretched so they can be read.
What we respond to

Whatever happened, call first.

  • Ransomware and extortion

    Encrypted systems, stolen data and ransom demands.

  • Business email compromise

    Hacked mailboxes, fake invoices and changed bank details.

  • Data theft and leaks

    Customer or company data copied out or posted online.

  • Cloud account takeover

    Stolen keys or admin accounts in AWS, Azure, Google Cloud or Microsoft 365.

  • Insider threats

    Staff or contractors misusing access, before or after they leave.

  • Website and app attacks

    Defaced sites, hidden web shells and card-skimming code.

  • AI incidents

    A chatbot leaking data, or an AI agent tricked into harmful actions.

  • Deepfake payment fraud

    Money sent after a fake call or video from a “leader”.

  • Something you cannot explain

    Not sure it is an incident? Call anyway. Ruling things out is part of the job.

How it works

Calm, in order, step by step.

  1. First call

    Triage

    What is happening, what is at risk and what must not be touched. You get the first three things to do.

  2. Right away

    Containment

    Cut the attacker’s access: isolate machines, disable accounts, block connections, without destroying evidence.

  3. First days

    Investigation

    Find how they got in, what they touched and whether data left, using logs, disk and memory evidence.

  4. Then

    Eradication and recovery

    Remove every foothold, rebuild from clean backups, reset credentials and watch for the attacker’s return.

  5. After

    Lessons learned

    A root-cause report and a hardening plan, so it does not happen again.

Do not switch everything off. Pulling the plug can destroy evidence held in memory, and paying a ransom does not guarantee your data back. Disconnect affected machines from the network, leave them powered on, and call us.
Be ready before it happens

Emergency call or retainer?

Calling in an emergency

Help arrives, but the clock is already running.

  • Contracts and NDAs signed mid-crisis
  • Responders learn your systems from scratch
  • Rates and availability not agreed
  • Nothing to pay in advance

Incident response retainer

Everything agreed while things are calm.

  • Contracts, NDA and contacts sorted in advance
  • We already know your systems
  • Response times and rates agreed in writing
  • Your plan tested in a tabletop exercise
What you get

From chaos to a clear account.

HANULSECIncident response report CLIENTSample · ransomware at a manufacturer SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical3High4Medium2Low1 TIMELINE · ROOT CAUSE · DATA AFFECTED RECOVERED Sample layout, not client data
  • 01
    Containment and recovery support

    Hands-on help until the attacker is out and systems are clean.

  • 02
    Forensic root-cause report

    How they got in, what they did, and what data was affected.

  • 03
    Reporting support

    Facts and drafts for CERT-In, the Data Protection Board, RBI, SEBI or IRDAI, your insurer and customers.

  • 04
    Hardening plan

    The fixes that stop the same attack working again, in priority order.

  • 05
    Tabletop exercise

    For retainer clients: a rehearsal of your plan with leaders and IT.

Who it is for

For the worst day, and the weeks before it.

  • Any organisation that would struggle to handle a ransomware attack alone
  • Regulated firms that must report incidents within hours
  • Companies whose cyber insurer expects an incident response plan
  • Boards that want a tested plan, not a document in a drawer
  • Teams already using a managed SOC who want response hours ready

Under attack right now?

Call +91 0080887899 any time, or email ir@hanulsec.com.

Disconnect affected machines from the network, but keep them switched on. Do not delete anything, and do not contact the attackers yet.

Frameworks

Following proven response methods.

NIST SP 800-61Incident handling
CERT-InDirections and audit guidelines
DPDP Act 2023With the DPDP Rules 2025
ISO/IEC 27037Evidence handling
MITRE ATT&CKAdversary behaviour
ISO/IEC 27001Information security

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01What should we do first if we are hit by ransomware?
Disconnect affected machines from the network but keep them powered on. Do not delete anything, do not wipe or reinstall, and do not contact the attackers yet. Call an incident responder, then check whether your backups are offline and untouched.
Q02Do we have to report a cyber incident in India?
Usually, yes. The CERT-In Directions of 2022 require many types of cyber incident to be reported to CERT-In within six hours of noticing them. From 13 May 2027, if personal data is involved, the DPDP Rules 2025 also require you to inform the Data Protection Board and each affected person without delay, and to send the Board a detailed report within 72 hours. Banks, market entities and insurers have sector rules as well.
Q03What is an incident response retainer?
An agreement signed before anything goes wrong. Contracts, NDAs, contacts and access are sorted in advance, response times and rates are agreed, and we learn your systems, so on the day we can start immediately.
Q04Should we pay the ransom?
That is your decision, made with your lawyers and insurer, and it should never be rushed. Paying does not guarantee you get your data back or that stolen data is deleted, and some payments raise legal problems. Our focus is recovering from clean backups so you have a choice.
Q05Can you help with the insurance claim?
Yes. We document the timeline, root cause, affected data and costs the way insurers expect, and work alongside the insurer’s own responders if they appoint them.
Q06Do you come on site?
Most investigation and containment can start remotely within the same call. When on-site work is needed, for example to collect evidence or rebuild systems, our responders travel to you.
Q07How is incident response priced?
Either as a retainer, with hours and response times agreed in advance, or per incident at an agreed rate. A retainer usually means faster help when it matters.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings