The First 72 Hours After a Cyber Incident

The first three days after a cyber incident decide most of what follows: whether the evidence survives, whether the insurer pays, whether notification deadlines are met, and how long the business is offline. The mistakes made in that window are rarely technical. They are decisions made fast by people who have never made them before. Here is the sequence we run, and the order we recommend to any organization that calls us mid-incident.

If this is happening now, call 703-486-0200 before reading further. After-hours and emergency response is billed at $275 per hour, published in the service menu.

Hour 0–4: Stop the Bleeding

1. Decide who is in charge. One incident lead. Not a committee. They decide, and every decision gets a timestamp and a name attached.
2. Isolate without destroying evidence. Disable compromised accounts. Block the sender or address at the email gateway. Move affected machines off the network. Do not power off and do not wipe; memory contents and running processes disappear at shutdown.
3. Assume email is compromised. Set up an out-of-band channel (phones, a separate chat workspace, a conference bridge) and tell the people who need it.
4. Call counsel and the insurer. Counsel directs the investigation so the work can be protected by privilege. The insurer decides who pays for forensics and whether you must use their panel firm. Read your policy’s notice clause; call the claims line even if you are unsure.
5. Do not talk to the attacker. No negotiation, no payment, no “just asking what they want” without counsel and the insurer involved.

Two minutes of containment decision-making beats two hours of scrambling. The pattern we see most often is a well-meaning administrator who rebuilds the server to “get everyone working again” and destroys the only record of how the attacker got in.

Hour 4–24: Scope and Preserve

Now the questions are: how did they get in, how long have they been inside, what accounts and systems did they touch, and what left the network?

• Preserve volatile data first: memory, running processes, network connections, logged-in sessions, and the contents of any remote-access tool.
• Collect logs before they roll over: identity provider sign-ins, VPN, email gateway, endpoint telemetry, firewall, and cloud audit logs. Export them, hash them, store them somewhere the attacker does not control.
• Image the affected disks and keep the images read-only. Nothing is analyzed on the original media.
• Build a timeline from the earliest suspicious event you can find to now. Note where the evidence is missing, because gaps are findings too.
• List exposed credentials and plan a rotation, but rotate after you know how the attacker is getting in, or you will hand them the new password.
• Check the mail rules: forwarding rules, delegates, and inbox rules that hide replies are the cheapest persistence an attacker gets.
• Tell staff what to do and give them one channel to report anything unusual. Do not blame anyone; you need reports, not silence.

Day 2–3: Contain, Recover, and Decide

1. Close the entry point before restoring. Rebuilding onto an unpatched server or an unchanged password re-infects you within days.
2. Restore from verified backups, in priority order, and confirm integrity before returning a system to production. If the backups were reachable from the compromised network, assume they are compromised.
3. Rotate everything the attacker could have touched: passwords, API keys, tokens, certificates, and any shared secret in a script or config file.
4. Decide on notification with counsel. Deadlines and audiences depend on the data, the state, the contracts, and the regulator. Getting this wrong in either direction is expensive.
5. Write down the decisions. Who decided, when, on what information. This is the document your insurer and your counsel will ask for.
6. Keep a communications cadence: staff, key clients, and the insurer on a fixed schedule, even when the update is “no change”.

What Not to Do

• Do not wipe, reinstall, or rebuild a system before it is imaged.
• Do not delete the phishing email or empty the quarantine. That is evidence.
• Do not run a “cleanup” tool and declare the incident closed. Commodity cleaners miss persistence and destroy indicators.
• Do not delay the insurer call until you understand the incident. Late notice is one of the most common reasons claims get disputed.
• Do not send client or regulator notifications drafted by the same person managing the technical response. Get counsel on the language.
• Do not promise a timeline you cannot support. Say when the next update will come.

Who to Call

• Incident response and forensics: Envescent incident response, 703-486-0200.
• Outside counsel with breach experience, engaged through the insurer if the policy requires it.
• Your cyber insurer’s claims line, using the number in the policy, not one found in an email.
• Law enforcement (FBI IC3 or local police) as a decision made with counsel, based on the crime type and your obligations.

The technical depth behind evidence handling is on the digital forensics page. Preparing in advance is cheaper than any of this: fill in the incident response plan template and test the contact tree twice a year.

What to Document

Keep one incident log with, at minimum: the time each event was noticed, who noticed it, what was done, by whom, when, the reasoning, and the result. Record the systems and accounts in scope, the evidence collected with hashes and storage location, the decisions taken (containment, notification, payment, law enforcement), and the people informed.

This log becomes the backbone of the forensic report, the insurance claim, and any regulatory response. It is also the only reliable way to answer “how long were they inside?” three weeks later.

When to Involve Counsel and Insurers

Immediately, not eventually. Counsel’s involvement early is what makes the investigation defensible and can protect the work product. The insurer’s involvement early is what gets forensics paid for and keeps you inside the terms of the policy. The two calls take twenty minutes and prevent most of the disputes we see afterwards. Our article on what insurers ask after a claim lists the records they request, and the assessment page explains how to build the evidence before you need it.

One more piece of advice that costs nothing: decide today who the incident lead is, and tell that person. Organizations that have already answered that question lose less time in the first hour than organizations that have better technology.