Managed Security
Cyber incident response and ransomware recovery in Egypt
Under attack right now, or want to be ready if it happens? Our incident response team contains threats, investigates what happened, restores your systems and helps you come back stronger.
Under attack now? Call or WhatsApp us immediately.
Set up an IR retainer
Thanks, we've got it.
A security engineer will call you back. If you're under attack now, call or WhatsApp us instead.
When an attack happens, every minute counts
A cyber incident rarely announces itself clearly. Files won’t open and a ransom note appears on screens. A customer reports strange emails from your accounts. The bank questions a payment you didn’t approve. Systems slow down for no obvious reason. In those first hours, decisions matter: what to shut down, what to preserve, who to tell, and how to get the business running again.
Without preparation, companies often make the situation worse: wiping infected machines and destroying evidence, restoring from backups that are already compromised, or reconnecting systems before the attacker is removed. Meanwhile, the pressure to pay a ransom grows.
ITZone’s incident response service brings calm, experienced help. We contain the attack to stop it spreading, investigate how it started and what was affected, remove the attacker, restore systems from clean backups, and help you strengthen defences so it doesn’t happen again. We also help businesses prepare in advance with incident response plans, tabletop exercises and retainers, so help is ready when it’s needed.
Is this you?
Tick what sounds familiar. We’ll include it with your quote request.
Sounds familiar? We'll send what you ticked with your quote request, so the engineer who calls already knows. Get my quote ↑
What we do during an incident
Triage
Understand what’s happening, how serious it is and what’s at risk.
Containment
Isolate affected systems, disable compromised accounts, block attacker access and stop spread.
Evidence preservation
Capture logs and system data before they’re lost, for investigation and possible legal or insurance needs.
Investigation
Find how the attacker got in, what they did, which systems and data were affected, and whether data was stolen.
Eradication
Remove malware, backdoors and attacker accounts.
Recovery
Restore systems and data from clean backups, rebuild where needed, and bring services back in priority order.
Communication support
Help preparing updates for management, staff, customers, insurers and authorities where required.
Lessons learned
A report with root cause, timeline and improvements.
Not sure where your gaps are?
Book a free security assessment and we’ll show you what to fix first.
What is ransomware?
Ransomware is malicious software that encrypts an organisation’s files and systems, making them unusable, and demands payment, usually in cryptocurrency, for the key to unlock them. Modern ransomware gangs often steal data first and threaten to publish it if the ransom isn’t paid, which is known as double extortion. Ransomware typically gets in through phishing emails, stolen passwords, exposed remote access or unpatched systems, then spreads across the network before encryption starts.
Paying a ransom doesn’t guarantee recovery, may fund further crime, and can carry legal risks. The best protection is prevention and preparation: MFA, patching, EDR, monitoring, segmentation, and offline or immutable backups that are tested regularly. See Endpoint Security and Backup & Disaster Recovery
What is incident response?
Incident response is the organised approach to preparing for, detecting, containing and recovering from cyber security incidents. A widely used model, based on NIST guidance, has four phases:
| Phase | What happens |
|---|---|
| Preparation | Plans, roles, tools, backups and training in place before an incident |
| Detection and analysis | Spotting the incident, confirming it and understanding its scope |
| Containment, eradication and recovery | Stopping spread, removing the threat, restoring operations |
| Post-incident activity | Lessons learned, improvements and reporting |
Do you have an incident response plan?
An incident response plan is a written guide for what your organisation does when a cyber incident happens: who is in charge, who to call, how to contain common incidents, how to communicate, and how to recover. We create practical plans tailored to your business, with playbooks for the most likely incidents, such as ransomware, email compromise, data leaks and payment fraud, plus contact lists and decision checklists. Then we test them in tabletop exercises with your management team, so everyone knows their role before a real incident.
Incident response retainer
A retainer means our team is already familiar with your environment, contacts and systems, with agreed response times, so we can act immediately when something happens. Retainers usually include onboarding, an incident response plan review, a tabletop exercise, and priority access to our responders.
What to do in the first hour
- Don’t panic, and don’t switch everything off at once. Disconnect affected machines from the network instead of powering them down, to preserve evidence.
- Don’t pay or contact the attackers before getting advice.
- Change passwords from a clean device, starting with admin and email accounts, and enable MFA.
- Protect your backups. Disconnect them if they’re still reachable.
- Call for help from your incident response provider and inform your cyber insurer if you have one.
- Report the crime to the relevant Egyptian authorities, such as police cybercrime channels.
- Write down what you see, with times.
Responding to email account takeover and invoice fraud
Not every incident involves malware. When an email account is compromised, attackers often watch conversations quietly, then send convincing payment instructions or forward invoices with changed bank details. If this happens, we secure the account, remove malicious rules and sessions, search for related emails sent to customers and suppliers, identify what data was accessed, and help you contact your bank quickly, because the chance of recovering funds is highest in the first hours. We then harden email security to prevent a repeat.
Practising before a real incident
A tabletop exercise is a guided discussion where your management and IT team walk through a realistic scenario, such as ransomware on a Thursday afternoon before a long weekend. We introduce new developments as the scenario unfolds and ask who decides what. Exercises reveal gaps in plans, contacts and authority in a safe setting, and leave teams far more confident. Most organisations run one or two a year.
After the incident
Recovery isn’t the end. We provide a report with a timeline, root cause and recommendations, and help you implement improvements such as MFA, EDR, segmentation, immutable backups and monitoring. Many clients move to a managed SOC afterwards, so the next attack is caught early. We also review what worked and what didn’t in your response, and update your plan.
Who needs incident response support
Every business. Even with strong defences, incidents happen; what matters is how quickly and calmly you respond. Retainers are especially valuable for companies with cyber insurance obligations, regulated data, critical operations or limited in-house security skills.
Case study
An Egyptian logistics company was hit by ransomware over a weekend. We isolated the affected servers, confirmed backups were clean, restored critical systems and traced the entry point.
Incident Response questions, answered
What is ransomware?
Malicious software that encrypts files and systems and demands payment to unlock them, often after stealing data.
What is incident response?
The organised approach to preparing for, detecting, containing and recovering from cyber security incidents.
Should we pay the ransom?
Get expert advice first. Payment doesn’t guarantee recovery and may carry legal risks. Many organisations recover from backups without paying.
How quickly can you respond?
Retainer clients get priority response within agreed times; others are supported as quickly as capacity allows.
Can you recover encrypted files?
Usually through clean backups. Decryption without the key is rarely possible, which is why protected backups are essential.
Do you work with insurers and lawyers?
Yes. We provide evidence and reports for insurance claims and legal advisors.
Do you provide digital forensics?
We investigate incidents and preserve evidence; for court-level forensics we work with specialist partners.
Can you write our incident response plan?
Yes, including playbooks and tabletop exercises.
What information will you need from us during an incident?
Access to affected systems and logs, network and backup details, and a decision-maker available to approve actions.
Do you help notify customers or authorities?
We support communication planning and provide facts for notifications; legal advisors should confirm obligations.
Will you need to come on site?
Most response work can be done remotely; we come on site where physical access or hands-on recovery is needed.
Can you help us check whether our backups would survive ransomware?
Yes. We review backup design and test restores as part of preparation services.
Do you support businesses across Egypt?
Yes, remotely and on site across Egypt.
Related services
Managed SOC
24/7 monitoring, detection and response across your systems.
Endpoint Security
Advanced protection for every laptop, desktop and server.
Backup & Disaster Recovery
Backups that are checked, and a plan for when things go wrong.
Security Assessment
A clear picture of your risks and what to fix first.