The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →If you suspect your small business has been hacked, disconnect affected devices or systems from the network as safely as you can, coordinate actions through one incident lead, and contact a qualified incident-response or digital-forensics professional. Don’t automatically power a computer off: shutting it down can destroy evidence, and the right action depends on the circumstances and responder guidance. Involve legal counsel promptly if personal information, regulated data, or contractual duties may be involved.
A post-intrusion assessment should do more than clean up visible symptoms. It should establish how access may have occurred, which systems and information may be affected, whether the attacker may still have access, what evidence supports those findings, and what must change before recovery.
As an Amazon Associate I earn from qualifying purchases.
What should you do first after a suspected cyber intrusion?
Coordinate and contain the incident
Use your incident-response plan if you have one. Name a business lead to coordinate technical work, operations, communications, and legal decisions. That person should keep a record of key actions and decisions, including when systems were isolated and whom the business contacted.
Work with your IT staff or responder to isolate affected devices and systems from the network. The aim is to limit further access and spread without needlessly changing or destroying evidence. If you suspect the attacker may be monitoring compromised systems, use a separate, trusted channel for incident coordination where appropriate; messages sent through affected systems could alert the attacker. See CISA’s #StopRansomware Guide.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Should you turn off a hacked computer?
Not as an automatic first step. The Federal Trade Commission (FTC) advises businesses not to power down devices before forensic experts arrive, while CISA warns that powering down can destroy volatile evidence and treats it as a fallback if other disconnection methods are not possible. A responder may need evidence held in a device’s memory, so ask for direction as soon as you can. If a device cannot be disconnected from the network in another way, CISA describes powering it down as a fallback—not a universal rule for every incident.
Prioritize safety and essential operations. Don’t let preserving a computer take precedence over a risk to people or critical services. Avoid unnecessary use or changes to affected devices, and don’t make public claims about what was accessed or stolen before you have evidence to support them.
Who should you call?
Build a response team around the incident
The right team depends on the business and the incident. The FTC recommends considering expertise in forensics, legal matters, information security, IT, operations, human resources, communications, and management. A small company may rely on outside specialists for some of these roles, but someone inside the business should coordinate decisions and provide responders with operational context.
Consider an independent forensic investigator or incident-response provider who can establish the source and scope of the incident, preserve and analyze evidence, and recommend remediation. CISA strongly encourages organizations responding to a data breach to consider help from a reputable third-party incident-response provider. That is a recommendation about a service category, not an endorsement of a particular company. The CISA fact sheet on sensitive and personal information in ransomware-caused data breaches provides additional context.
Choose a responder by scope and capability
Before agreeing to work, ask the provider to explain its relevant incident experience, how it will preserve and analyze evidence, what the engagement covers, what deliverables you will receive, and how it will coordinate with your counsel and business operations. Ask who will make decisions about changes to affected systems and how urgent findings will be communicated. These are practical selection questions based on the tasks official guidance assigns to responders; they are not a certification or guarantee of provider quality.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Consult legal counsel as well, potentially including outside counsel with privacy and data-security experience. Counsel can help assess legal and contractual obligations and coordinate communications; a technical assessment alone does not determine those duties.
What should a post-intrusion assessment establish?
Ask for findings that separate confirmed facts from reasonable inferences and unresolved questions. An assessment is useful when it connects available evidence to business impact and decisions—not merely when it identifies malware or restores a machine.
| Assessment area | Questions to answer | Why it matters |
|---|---|---|
| Systems and accounts | Which devices, servers, cloud services, and user or administrator accounts were affected? | Defines the incident’s operational scope and what needs containment or review. |
| Entry route and timeline | What likely allowed access, and what timeline do the available records support? | Helps distinguish a known initial path from events that remain uncertain. |
| Continuing access | Is there evidence of persistence, active access, or other compromise that could survive basic cleanup? | Informs containment and reduces the risk of restoring an unsafe system. |
| Information at risk | What information may have been accessed, acquired, changed, or exposed, and what evidence supports that conclusion? | Supports business decisions and the legal review of notification duties. |
| Control gaps and remediation | Which vulnerabilities or controls contributed, and what should be fixed before systems return to service? | Connects the incident investigation to safer recovery and prevention. |
These are practical assessment goals drawn from the FTC’s guidance on determining a breach’s source and scope and verifying what information was compromised, and CISA’s response guidance on determining affected systems and reviewing logs. The evidence available may not support a definitive answer to every question. A good report should identify those limits rather than present an unverified possibility as fact. See the FTC’s Data Breach Response: A Guide for Business and CISA’s guide.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should you preserve evidence?
Coordinate collection with qualified responders before making unnecessary changes to affected machines. Evidence may disappear through routine log rotation, shutdown, reboots, cleanup, or continued use. CISA specifically identifies system memory, Windows Security logs, and firewall log buffers as volatile or limited-retention evidence.
- Tell responders which systems and accounts appear affected, what unusual activity was noticed, and what actions have already been taken.
- Ask them to prioritize potentially short-lived evidence and relevant records from endpoints, network devices, and cloud services.
- Preserve relevant business records and communications, and record the timing of actions taken during the response.
- Do not attempt forensic imaging or memory capture yourself unless qualified responders direct and support that work.
Evidence handling is a technical task, not a reason to leave a suspected compromise unchecked. CISA’s guidance explains the trade-off: containment matters, but some actions can destroy evidence that may help establish scope or cause.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
What should you do about customer notices and reporting?
Notification is fact- and jurisdiction-specific, not a single universal step with one deadline. In the United States, the FTC says every state, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands has a law requiring notification for security breaches involving personal information. Requirements differ, and other obligations may depend on the data, industry, contracts, affected parties, and incident facts. Ask counsel to assess the applicable rules and deadlines; don’t rely on a generic notice or a deadline from another jurisdiction.
Coordinate the timing and content of notices with counsel and, where appropriate, law enforcement so that communications do not impede an investigation. The FTC recommends communicating clearly with affected audiences, not misleading people or withholding key protective information, and avoiding disclosures that could put consumers at further risk. Assign a point person to handle questions and keep public statements grounded in verified facts.
Reporting an incident to an agency is not a substitute for legally required notices. Depending on the event, CISA says organizations can consider reporting to CISA, a local FBI field office, the FBI Internet Crime Complaint Center, or the U.S. Secret Service. FTC guidance also discusses contacting local law enforcement and, where appropriate, FBI or Secret Service offices. Choose a route with counsel or your response team based on the incident.
When is it safe to restore systems?
Restore only after the response team has determined the containment and remediation steps needed to reduce the chance of reinfection. CISA advises prioritizing critical services and restoring from offline, encrypted backups, while ensuring compromised systems are not reintroduced into a clean recovery environment. Confirm that the backup and recovery plan fits the incident; a backup is not automatically safe simply because it exists.
After recovery, document lessons learned and update the response plan, security controls, and procedures. The FTC also advises fixing vulnerabilities and implementing recommended remediation. For organizations reviewing their incident-response approach, NIST Special Publication 800-61 Revision 3 is the current revision identified by NIST in its April 2025 update; it supersedes Revision 2. These U.S. sources offer operational guidance, but they do not determine a particular business’s legal duties, incident scope, or technical remediation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
