What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
After a cyberattack, secure the business in this order: activate a coordinated response, contain the intruder without destroying evidence, determine what was affected, report and obtain specialist help when needed, restore critical services from clean backups, review notification duties, and then harden the environment. Containment stops or limits ongoing access; recovery returns trusted services. Treating those as the same task is a common way to reinfect systems or lose evidence.
This is general operational guidance, not legal advice. The correct actions depend on the intrusion, affected systems and data, industry, contracts, and the jurisdictions involved. The examples below use U.S. government guidance from the Cybersecurity and Infrastructure Security Agency (CISA); businesses elsewhere must identify their own authorities and rules.
As an Amazon Associate I earn from qualifying purchases.
1. Activate the response process and put one person in charge
Do not let the first person who notices the attack improvise alone. Open the incident-response process, name an incident leader, and establish a written record of decisions, times, systems, and people involved. The leader may be an internal executive, an information-security manager, or an external responder, but responsibility must be explicit.
Free tools Windows power users keep installed
One-click scans. No signup required.
CISA’s corporate-leadership guidance says, “Cyber incident response plans should include not only your security and IT teams, but also senior business leadership and Board members.” The practical implication is that technical staff should not make business-continuity, customer-communications, employment, or legal decisions in isolation.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Bring the right functions together
- Technical response: IT, security, cloud, identity, networking, and application owners.
- Business operations: owners of critical services such as payments, production, dispatch, customer support, or clinical operations.
- Leadership: the executive who can authorize downtime, emergency spending, and risk acceptance.
- Legal and privacy: counsel or a qualified privacy professional to assess notification and contractual duties.
- Communications: one person who coordinates employee, customer, partner, regulator, and media messages.
- Continuity and vendors: backup, hosting, managed-service, payment, and other providers that may hold relevant logs or restore capabilities.
- Insurance and finance: the cyber-insurance contact and people who can preserve coverage requirements and approve response costs.
Set operating rules immediately
- Create a dedicated, access-controlled incident log. Record UTC or local time consistently, the source of each fact, decisions, approvals, and unresolved questions.
- Move sensitive coordination to a communication channel that is not dependent on a potentially compromised email or collaboration account.
- Tell employees not to delete files, reset devices, negotiate with attackers, or post publicly unless the response leader authorizes it.
- Define an escalation threshold: for example, suspected access to regulated data, privileged accounts, safety systems, payment systems, or core production should trigger leadership and legal review.
- Assign deputies for every critical role so the response can continue across shifts.
If the organization lacks the ability to make containment or forensic decisions safely, obtain incident-response or digital-forensics assistance rather than guessing.
2. Contain the intrusion without destroying evidence
Containment aims to stop or limit the attacker’s access. It is not the same as wiping devices or restoring services. The correct isolation action depends on whether the compromise involves a laptop, server, cloud account, identity provider, network segment, operational technology, or a third-party service.
Choose isolation actions deliberately
- Isolate confirmed or strongly suspected affected devices and segments from the network when doing so will not create an unsafe business or physical consequence.
- Disable or restrict compromised accounts, tokens, remote-access paths, and exposed administrative interfaces after considering which emergency access the business still needs.
- Block known malicious infrastructure and suspicious persistence mechanisms at appropriate control points.
- Separate unaffected critical systems from the incident environment rather than connecting everything to make troubleshooting easier.
- Coordinate with cloud, hosting, telecommunications, and managed-service providers when the affected control is outside your administration.
Do not automatically power off every device, reimage the first machine you find, or reset every password before collecting information. Those actions can erase volatile evidence, interrupt safety-critical functions, or alert an attacker before the team understands the scope. A responder should document the reason, expected benefit, and risk of each disruptive action.
When the attack is still active
Assume that an attacker may have more than one foothold until the investigation shows otherwise. Watch for newly created accounts, unexpected administrative activity, remote-management tools, scheduled tasks, altered authentication settings, unusual data transfers, and access from unfamiliar locations. Preserve the relevant telemetry before retention windows overwrite it.
3. Preserve evidence and establish the scope
Evidence can be volatile. Memory contents, active network connections, cloud audit events, endpoint telemetry, and authentication logs may disappear quickly or be overwritten. CISA’s ransomware guidance recommends capturing evidence and relevant logs; a CISA advisory also recommends detailed reporting information such as affected infrastructure and attack dates.
Preserve what can answer the key questions
- Which devices, servers, cloud resources, applications, accounts, and network segments were affected?
- When did the initial compromise, privilege escalation, lateral movement, data access, encryption, or disruption occur?
- Which credentials, keys, tokens, certificates, and service accounts may have been exposed?
- What data was viewed, copied, altered, deleted, or encrypted, and where was it stored?
- Which third parties had access or were connected during the relevant period?
- What controls were bypassed, misconfigured, or missing?
Collect and protect records
- Preserve system images, memory captures, endpoint alerts, firewall and VPN records, identity-provider logs, cloud audit trails, email logs, and relevant application logs when appropriate.
- Export logs in a way that retains timestamps, time-zone information, source identifiers, and integrity metadata.
- Record who collected each item, when, from which system, with what tool, and where the original and working copies are stored.
- Restrict access to evidence and keep a separate copy that the investigation cannot accidentally alter.
- Ask counsel or a qualified forensic specialist about preservation requirements if litigation, regulatory review, or law-enforcement involvement is possible.
Separate confirmed facts from hypotheses. A worksheet with columns for “confirmed,” “suspected,” “unknown,” “owner,” and “next evidence needed” prevents an early assumption from becoming the official story.
4. Escalate, report, and coordinate outside help
Use the response plan to decide whom to contact, then make those contacts early enough to preserve options. Depending on the facts, that may include CISA, law enforcement, regulators, a cyber insurer, critical vendors, payment partners, or customers whose operations depend on yours.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Prepare a concise incident brief
Before calling an authority or provider, assemble the information you can verify:
- Organization name, location, industry, and a technical and executive point of contact.
- Discovery time, suspected attack dates, current operational impact, and whether the attacker still appears active.
- Affected infrastructure, accounts, services, and data categories.
- Known indicators such as malicious domains, addresses, file hashes, account names, or ransom notes, handled through an appropriate secure channel.
- Containment actions already taken and the business consequences of those actions.
- Whether a forensic responder, insurer, counsel, or service provider is engaged.
CISA describes assistance and reporting options in its ransomware guidance and recommends reporting compromises to applicable authorities. An authority may provide information, coordination, or investigative support, but do not promise a particular service or response time to employees or customers.
Use specialist responders when the decision risk is high
Third-party incident-response and digital-forensics support is especially valuable when privileged accounts are compromised, the attacker’s dwell time is unknown, evidence is likely to be contested, the organization has no mature response team, or restoration could spread the compromise. Confirm who controls evidence, who can authorize disruptive actions, how communications are protected, and how the provider will coordinate with counsel and the insurer.
5. Build a recovery order around business criticality
Recovery should return trusted services in a controlled sequence, not simply bring every machine online. CISA’s ransomware guidance says, “Reconnect systems and restore data from offline, encrypted backups based on a prioritization of critical services.” Restoration must also avoid reintroducing compromised devices, accounts, or configurations.
Recommended Free Tools
Compare restoration choices using these axes
| Decision axis | Questions to answer | Safer choice when uncertain |
|---|---|---|
| Business criticality | Which functions protect life, safety, revenue, legal compliance, or basic communication? | Restore the smallest set that keeps essential operations running, then expand in stages. |
| Backup trust | Is the copy offline, encrypted, dated before compromise, and tested for restoration? | Use a known-good offline copy and validate it before broad deployment. |
| Evidence and reinfection risk | Could restoration overwrite evidence or reconnect a compromised identity, host, or network path? | Preserve required evidence and rebuild in an isolated environment first. |
| Available expertise | Can the internal team verify eradication, identity security, and application integrity? | Bring in qualified incident-response or forensic help when it cannot. |
| Notification exposure | Does the recovery action change what can be established about affected data or timing? | Coordinate technical findings with counsel before making definitive statements. |
Use a staged restoration procedure
- Define the clean-room boundary. Create an isolated recovery network or equivalent separation, with tightly controlled administrative access.
- Verify the source. Check backup dates, encryption, integrity, and provenance. Do not assume the newest copy is clean.
- Rebuild or re-provision. Use trusted installation media, current security updates, secure configuration baselines, and newly issued credentials and keys.
- Validate dependencies. Test identity, DNS, time synchronization, certificates, backups, monitoring, application integrations, and vendor connections before exposing the service.
- Restore one critical service at a time. Run functional and security checks, monitor closely, and document the result before proceeding.
- Reconnect gradually. Apply least-privilege network paths, heightened logging, and an explicit rollback plan.
- Retain the original incident state. Do not destroy affected systems or backup copies until the investigation, contractual, and legal preservation needs are resolved.
Ransomware-specific precautions
Ransomware recovery adds a difficult choice about encrypted systems, extortion demands, and possible data theft. Do not assume that paying restores data, removes the attacker, or prevents publication. Preserve the ransom note and affected media, involve counsel and the insurer, and ask a qualified responder to determine whether decryption, rebuilding, or another path is appropriate. Any decision must account for sanctions, criminal-law, regulatory, safety, and continuity risks that vary by jurisdiction and case.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Review notification, privacy, and contract duties
There is no single breach-notification deadline that applies to every business. The answer depends on the affected data, the organization’s role, the state or country, the sector, contracts, and what the investigation establishes.
Make the legal review fact-specific
- Identify the locations of affected individuals and the jurisdictions in which the business operates.
- Classify the data involved, including credentials, financial information, health information, employee records, customer content, and confidential business information.
- Check sector rules, state breach-notification laws, contractual notice clauses, payment-network requirements, and government or customer reporting terms.
- Determine whether the business is a data owner, processor, service provider, or another role under the applicable rule.
- Record when the organization discovered the incident, when it had enough facts to assess risk, and which notices were sent, by whom, and when.
CISA’s guidance directs organizations to applicable state breach-notification requirements and, for certain health information, points to Federal Trade Commission or Department of Health and Human Services rules. Consult qualified legal counsel rather than announcing a universal deadline or sending an incomplete notice that later conflicts with verified facts.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Keep communications accurate and useful
Employee and customer messages should state what is known, what is being done, what recipients should do, and where updates will appear. Avoid speculation about the attacker, unsupported claims that no data was accessed, or technical detail that could help the attacker. Establish one approved spokesperson and a schedule for updates even when there is no material change.
7. Harden the environment based on what failed
A recovery is incomplete if the same access path remains open. Convert the investigation’s findings into owners, deadlines, and verification tests.
Identity and access
- Reset compromised passwords and revoke sessions, tokens, API keys, certificates, and recovery methods that may have been exposed.
- Require multifactor authentication for remote access, email, administrator accounts, and other high-impact systems. A hardware security key using a compatible FIDO2 method can be considered where it fits the organization’s systems; verify compatibility before deployment.
- Remove dormant accounts, shared administrator credentials, excessive privileges, and vendor access that no longer has a business owner.
- Separate daily accounts from administrative accounts and require approval for high-risk changes.
Endpoints, networks, and cloud systems
- Patch the exploited software or disable the vulnerable service until a safe fix is available.
- Segment critical services so compromise of an office workstation does not provide a direct path to backups, identity systems, or production controls.
- Enable centralized logging and alerting for authentication, privilege changes, data exports, endpoint protection, and cloud administration.
- Review email forwarding rules, OAuth grants, remote-management tools, startup items, scheduled tasks, and firewall changes for persistence.
- Use secure configuration baselines and verify them after rebuilding, not only during annual audits.
Backups and continuity
- Maintain offline, encrypted backup copies with separate administrative credentials.
- Test restoration of representative systems and data, including dependencies and recovery-time expectations.
- Protect backup consoles and repositories as carefully as production identity systems.
- Document manual workarounds for the critical functions that cannot be restored quickly.
An external encrypted drive may be one component of an offline-backup design, but a drive by itself is not a tested backup system. Choose media, retention, access controls, and geographic separation that match the business’s recovery requirements.
8. Turn the incident into a tested capability
CISA’s corporate guidance emphasizes leadership participation, critical-function continuity, and planning; its ransomware guidance calls for lessons-learned review and plan updates. Schedule that review after operations stabilize, while evidence and decisions are still available.
Run a structured after-action review
- Write a factual timeline from initial access through containment, notification decisions, restoration, and monitoring.
- Identify the first detectable signal, the control that should have caught it, and why it did not produce a useful response.
- Measure decision delays: detection to escalation, escalation to containment, containment to clean restoration, and restoration to normal monitoring.
- List technical, process, staffing, vendor, and communication failures separately.
- Assign every corrective action an owner, due date, dependency, and verification test.
- Update the incident plan, contact tree, asset inventory, backup runbook, and continuity procedures.
Exercise the revised plan
Test a scenario that matches the weakness you found: a stolen administrator session, a cloud compromise, a supplier breach, or ransomware during a peak business period. Include senior leadership and the owners of critical functions, not only IT. Confirm that people can reach the plan, operate without the primary collaboration system, restore a service from an offline copy, and make a notification decision with counsel.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutePractical checklist for the first days
- Incident leader, deputies, technical owners, leadership, legal, communications, continuity, insurer, and provider contacts identified.
- Compromised devices, accounts, services, and network paths isolated with documented rationale.
- Logs, images, memory captures, alerts, and relevant communications preserved appropriately.
- Scope worksheet distinguishes confirmed facts, assumptions, and unknowns.
- CISA, law enforcement, insurer, regulators, and affected providers considered according to the facts.
- Critical-service restoration order approved, with clean-room boundaries and rollback criteria.
- Offline encrypted backups validated before use; rebuilt systems and credentials checked for reinfection risk.
- Legal and contractual notification requirements identified for every relevant jurisdiction and data type.
- Credentials, tokens, keys, certificates, persistence mechanisms, and vendor access reviewed.
- Lessons-learned actions assigned, tracked, and tested through an updated exercise.
For small and midsize organizations, CISA’s Small and Medium-Sized Business Resources provide an entry point for incident-response planning and reporting. Use official guidance as a starting framework, then adapt the roles, evidence handling, recovery order, and notification analysis to the systems and laws that actually govern the business.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
