Home / Guides

Understand the risk. Command the response.

What executive leadership, CISOs, and infrastructure teams need to know about modern attack chains, personal board accountability, hardware-locked backups, and the first hours after a breach.

Governance & liability: what regulators and boards expect

NCSC Cyber Governance Code, UK GDPR, and NIS Regulations: What applies to you?

Regulatory accountability has tightened across the United Kingdom: directors face clear duties under s.174 of the Companies Act 2006, the NCSC Cyber Governance Code of Practice, the NCSC Cyber Assessment Framework (CAF), 72-hour ICO reporting under UK GDPR, and the UK NIS Regulations (alongside EU NIS2 and DORA for cross-border supply chains). Even mid-market firms are pulled into strict compliance through enterprise customer contracts and London Market underwriting.

The common denominator across every framework: cyber risk management, backup resilience, and incident reporting sit directly with executive leadership and the board of directors. Operational tasks can be delegated to IT; director duties cannot. Resilient structures must be built before the first audit or breach.

Board governance and CISO advisory at Identiqa

The first day after the attack

The first hours after a breach determine the next several weeks. The mandatory sequence: contain lateral spread at the network edge and host layer, preserve forensic evidence, satisfy regulatory reporting windows (such as SEC Form 8-K materiality assessment, 72-hour data-protection notifications, or the 24-hour NIS2 early warning), and only then restore from verified immutable backups. Wiping and rebuilding servers prematurely often destroys evidence required by cyber insurers and regulators.

That's why Identiqa staffs a 24/7 human incident response team: seasoned responders who execute this sequence with your team day or night, including taking over active ransomware extortion.

Reach 24/7 incident response

The attack: what your organisation is up against

How mid-market and enterprise networks actually get breached

Four entry vectors account for the vast majority of real-world breaches: targeted phishing and business email compromise (the classic prelude to encryption), organized ransomware-as-a-service operations, unpatched zero-day vulnerabilities in perimeter firewalls and VPN appliances, and supply-chain intrusions through third-party service providers.

Real attacks almost always chain several vectors together: a phishing payload or firewall flaw opens the door, stolen credentials expand privileges, and ransomware deployment comes last. Point tools that guard only one layer leave the rest of the chain open.

How Identiqa defends every entry vector

What actually happens inside a ransomware attack

A ransomware attack is never a sudden lightning strike; it's a quiet multi-day operation. After initial entry, attackers plant reboot-surviving persistence, map your internal network, exfiltrate sensitive data, and hunt down your backups. In 94 per cent of ransomware attacks, adversaries go after the backups, and they succeed 57 per cent of the time. Organisations whose backups were compromised were almost twice as likely to pay the ransom (Sophos 2024).

Break the chain early, at the network edge and on your servers, and hold an immutable backup copy, and you restore instead of negotiating. Backups can't stop attackers from threatening to leak stolen data, though. That takes catching exfiltration early.

See how AuraLink with ProtectionGrid works

Your defence: what holds up under fire

How do I protect my organisation effectively?

Effective defence starts with five non-negotiable fundamentals: phishing-resistant multi-factor authentication everywhere, rapid vulnerability patching without multi-week backlogs, storage-locked immutable backups, network segmentation instead of a flat internal LAN, and an annual restoration drill.

Above that baseline sits the operational defence layer that keeps your team from burning out: automated edge containment, continuous server persistence hunting, and a 24/7 incident response desk that answers at 3 a.m. That's what Identiqa is built for.

See how Identiqa protects you

Why conventional backups fail under fire

Nearly every company has backups. Whether those backups can actually restore operations during a ransomware crisis comes down to one question: are the backup repositories reachable using the same domain admin credentials or network paths as production? If they are, attackers will encrypt or purge them before launching the main strike.

True immutability isn't a software checkbox in a backup console; it's a cryptographic lock enforced by the underlying storage layer. Once written, a snapshot can't be overwritten or deleted during its retention window by anyone, even with stolen root or domain administrator rights.

Hardware-locked immutable backups at Identiqa

Cyber insurance: how to qualify and protect your coverage

Cyber insurance is an essential part of enterprise risk transfer, but policies pay out only when underwriting warranties are demonstrably met: phishing-resistant authentication, timely patching, segregated and immutable backups, and documented incident response procedures. Substandard controls can void coverage when you need it most.

Identiqa puts the exact technical controls and audit trails in place that underwriters scrutinize during binding and claims review, ensuring your policy remains the final safety net rather than the only one.

Cyber insurance readiness with Identiqa

The crisis: when an attack is already underway

Under attack right now: immediate first steps

Prioritize precision over panic: isolate affected segments from the network, but don't pull the power cord on running servers, as that destroys volatile forensic memory needed for containment and insurance claims. Make no commitments to extortion groups, and don't coordinate response over potentially compromised corporate email.

Bring in experienced responders immediately: Identiqa 24/7 incident response is reachable around the clock on our emergency line at +44 20 4634 2000; press the # key. The initial consultation is a flat EUR 380 plus VAT for up to one hour, with no ongoing retainer required.

Contact 24/7 incident response

Glossary: essential cybersecurity terms for decision-makers

Ransomware: Malware that exfiltrates data and encrypts production systems to extort payment, operated today as a specialized criminal enterprise.
Phishing: Deceptive messages engineered to harvest credentials or deliver initial access payloads; still the primary entry point into enterprise networks.
Zero-day vulnerability: A critical software or firmware flaw unknown to the vendor with no official patch available, frequently exploited in perimeter firewalls and VPN gateways.
Immutable backup: A backup snapshot cryptographically locked at the storage layer so that no user, script, or compromised administrator can alter or delete it during its retention period.
Persistence: Hidden mechanisms (such as unauthorised SSH keys, cron jobs, or systemd units) planted by an attacker to maintain access across server reboots.
Perimeter: The boundary between your corporate network and the public internet. Traditional firewalls filter ports there but miss exploits inside allowed traffic.
SOC: Security Operations Center: the 24/7 specialist team that monitors telemetry, investigates anomalies, and coordinates containment.
SIEM: Security Information and Event Management: a platform that aggregates logs for analysis and audit trails, but does not physically block attacks on its own.
Dark web: Non-indexed overlay networks where adversary groups trade stolen credentials, initial access broker listings, and exfiltrated corporate data.

In your rack. On the cloud contract you already have.

We size Identiqa to your infrastructure and sites. Buy directly through Identiqa or on your existing agreement with Amazon Web Services, Google Cloud, or Microsoft Azure.

Architecture briefing & advisory