The Founder's Guide to Surviving a Cyber Incident
Published · By Thiago Vieira · 3 min read · Cybersecurity
The first hours of a cyber incident decide most of its cost. Founders who isolate systems, preserve evidence and call the right people early recover faster and spend less. Founders who panic, wipe machines or pay immediately often lose both data and leverage.
Why founders are rarely ready
Most startups have no incident plan. Backups exist "somewhere", nobody knows who to call, and the founder learns about the attack from an employee who cannot open files on a Monday morning. In my forensic work, I see the same avoidable mistakes made under pressure.
The first hour: what to do
- Stay calm and contain. Disconnect affected machines from the network. Do not turn them off unless advised, and do not wipe or reinstall anything.
- Preserve evidence. Logs, ransom notes, suspicious emails, screenshots and affected files are evidence. Cleaning up destroys the trail you need to understand and recover.
- Call your incident contacts. Incident response or forensic specialist, lawyer and, if you have one, your cyber insurer. Many policies require early notification.
- Protect communications. Assume email and chat may be compromised. Use a separate channel to coordinate.
- Start a timeline. Write down what was noticed, when and by whom. That record will matter later.
What not to do
- Do not pay immediately. You do not yet know what can be recovered or who you are dealing with.
- Do not negotiate alone. Attackers are experienced; you are not.
- Do not destroy evidence by rebuilding systems before an examination.
- Do not hide it. Depending on your jurisdiction and the data affected, you may have legal notification obligations with short deadlines.
Recovering without paying the ransom
Paying is not the only path. A forensic recovery approach looks for every possible route back to your data:
- Clean backups and cloud snapshots, verified before restoring.
- Unencrypted copies on other devices, services or email.
- Weaknesses in specific ransomware variants and publicly available decryptors.
- Partial file recovery and reconstruction of critical records.
Not every case ends with full recovery, but many companies recover far more than they expected, without funding criminals.
After the incident
- Find the root cause. Without it, you will be hit again.
- Document everything. For insurers, regulators, clients and possibly courts.
- Fix the basics. Multi-factor authentication, patching, offline or immutable backups, least-privilege access.
- Write the plan you wish you had. One page: who to call, what to isolate, where backups are.
Turning a crisis into a controlled response
My keynote Ransomware Rescue walks audiences through real forensic cases of data recovered without paying the ransom, and the decisions that made the difference. It works for founder communities, executive teams and IT audiences alike. Book a keynote.
This article is general information, not legal or incident response advice for a specific situation.
Frequently asked questions
Should a company pay a ransomware demand?
Paying does not guarantee recovery, can fund further crime and may create legal exposure depending on who the attackers are. Before considering payment, get an incident response and forensic assessment of what can be recovered without paying.
What is the first thing to do after a ransomware attack?
Contain the damage by isolating affected systems from the network, without wiping or rebuilding them, and call your incident response contact. Preserve evidence before anyone starts "cleaning up".
Can data be recovered without paying the ransom?
Sometimes. Depending on the ransomware family, backups, snapshots, unencrypted copies and forensic techniques, part or all of the data may be recoverable. A forensic assessment is the only way to know.
Do small startups really get targeted?
Yes. Smaller companies are often attacked precisely because they have fewer defenses, weaker backups and no incident plan.