# What should we do first if we see these signs?

Disconnect the affected hosts from the network, keep their logs, reset the credentials used on them and call your incident-response provider. If your organisation is in scope of NIS2, the 24-hour early warning starts when you become aware of a significant incident.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/what-should-we-do-first-if-we-see-these-signs

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What should we do first if we are hit by ransomware?](https://netsenx.com/en/faq/first-steps-after-a-ransomware-attack)
- [What are the steps after a ransomware attack, in order?](https://netsenx.com/en/faq/steps-after-a-ransomware-attack-in-order)
- [Should we pay the ransom?](https://netsenx.com/en/faq/should-we-pay-the-ransom)
- [Should we pay a ransom if the attackers say they copied our data?](https://netsenx.com/en/faq/should-we-pay-if-attackers-say-they-copied-our-data)
- [What is a ransomware negotiator, and should we use one?](https://netsenx.com/en/faq/what-is-a-ransomware-negotiator)