How do we recover safely after a cyber incident?
In a controlled order, on a clean foundation and with your eyes open. First make sure the attacker's way in is closed and their accounts and tools are gone. Rebuild the core first: the directory, administrator accounts, the backup system and the firewall, with new credentials. Then restore systems in order of business priority, from backups you have checked were taken before the intrusion and scanned before use. Bring each system back on a monitored network segment before giving everyone access, and keep users on new passwords with multi-factor authentication (MFA). Tell staff what to report if something looks wrong, and expect recovery to take longer than the attack did. Keep watching the network closely for weeks; NetSenX flags renewed beaconing, scanning and lateral movement on every plan, which is often how an incomplete clean-up is noticed.