# Should we hire an incident-response firm or handle an incident ourselves?

Handle the first hour yourselves, and bring in a firm for anything beyond a contained single device. Your own team knows the systems, so it should isolate machines, start the log and preserve evidence. An outside firm brings what a small team rarely has: forensic tools and experience, knowledge of attackers' habits, contacts with law enforcement, and credibility with insurers and regulators. Call one when an attacker may still be active, when servers or many devices are affected, when data may have left, or when the incident may be reportable or lead to a claim. Check first whether your cyber insurance names a firm, since using another can affect cover, and agree in advance what access they will need. NetSenX is not an incident-response firm; the explained alerts and network history it keeps are what that firm will ask for on day one.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/should-we-hire-an-incident-response-firm-or-handle-it-ourselves

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [How do we tell customers what data was affected in a breach?](https://netsenx.com/en/faq/how-to-tell-customers-what-data-was-affected)
- [Can network evidence show that a specific customer's data did not leave?](https://netsenx.com/en/faq/can-network-evidence-show-a-customers-data-did-not-leave)
- [Who can we call for free help after a cyberattack?](https://netsenx.com/en/faq/who-to-call-for-free-help-after-a-cyberattack)
- [Should we report a cyberattack to the police?](https://netsenx.com/en/faq/should-we-report-a-cyberattack-to-the-police)
- [Could an insider stealing money with malicious code have been spotted?](https://netsenx.com/en/faq/could-an-insider-stealing-with-malicious-code-be-spotted)