Active cyber attack assistance.
When something is happening right now – a compromised account, suspicious access, a ransomware demand, money already moving – AICS members can scope and respond in the first hours, when the response matters most.
First hour priorities
- Identify what is actually compromised – account, device, network, all of the above.
- Preserve the evidence before it is overwritten.
- Stop the active access path (revoke sessions, rotate credentials, disconnect compromised devices).
- Contain financial movement (bank, exchange, processor, card scheme).
- Decide what must be reported and to whom (police, regulator, insurer, board).
How AICS members help
Scope the incident
What you have lost, what is still exposed, what an attacker can still do with what they have.
Preserve and triage evidence
The investigation later depends on what is preserved now. AICS members do this properly so the matter can be evidenced if it goes anywhere.
Coordinate the response
Across IT, banks, exchanges, telcos, insurer, lawyer, regulator – in the right order. The right sequence matters.
Hand off to specialists where needed
If your matter needs a different speciality – forensic investigation, data breach, identity protection – AICS practitioners refer to the right service inside the institute.
Currently under attack?
Engage an AICS practitioner immediately from the institute’s verified register.
View AICS practitioners