It is 8:47 on a Tuesday morning. An employee reports a cyber incident: their email is sending messages they never wrote, files on a shared drive are renaming themselves one by one, or a ransom note has appeared on a boardroom screen.
Payroll needs to run, clients need answers, and staff are watching how leadership responds. In moments like these, the first hour decides whether your business faces a bad morning or a bad quarter. Most businesses have no plan for those 60 minutes, and panicked decisions make everything worse.
In many organizations today, the first indication of a cyber incident comes from automated monitoring rather than a user report. Security platforms can detect suspicious logins, ransomware behaviour, unusual account activity, or malicious software and alert IT teams within minutes. In some cases, affected systems can even be isolated automatically before business operations are impacted.
Why the First Hour Is Different
Containment speed drives cost. An account reset at minute 10 is an inconvenience. The same account left open for two days can grow into a company-wide ransomware event, a full data breach, or weeks of downtime. According to the Government of Canada’s Get Cyber Safe program, small organizations are frequently targeted precisely because they lack formal response plans, and attackers count on the confusion that follows discovery.
Employees often notice unusual activity first, but they should not be the only line of defense. Modern cybersecurity programs (i.e., endpoint detection and response or EDR) and automated alerting identify suspicious activity before users experience visible symptoms. Employee reporting does remain important because it can provide more context and confirm an incident. Backups tell you what you can restore, but nothing about what your people should do in the next 60 minutes. Recovery infrastructure and incident response are two different disciplines, and the second one is decided by whoever stays calmest in the room.
Minute 0 to 15, Confirm and Contain
The clock starts the moment a potential incident is detected whether by an employee or your IT provider. The goal is early detection and rapid response, regardless of who discovers the issue first
Call the right people. The owner or manager should be informed, but if your organization has an internal IT team, managed service provider, or managed security provider, they may already be aware of the incident through automated monitoring and alerting systems. Early communication ensures everyone is working from the same information. Nobody else yet. One phone number, saved offline and taped to a wall somewhere, beats a frantic search through a compromised email account for the right contact.
Stop the spread. Affected systems should be disconnected from the network, but only when IT says so. Unplugging or powering off a machine can destroy evidence held in memory, so employees should not improvise and need to follow instructions.
Do no harm. Employees should not keep clicking to see if the problem fixes itself, delete the suspicious email or ransom note, or discuss the incident in a group chat the attacker may already be reading. One more rule. Nobody goes hunting for the attacker out of curiosity. Curious clicks during an active incident destroy the very evidence IT will need.
Minute 15 to 30, Preserve Evidence
Once systems are contained, attention shifts to protecting the record. Insurance claims, potential legal obligations, and the investigation into what the attacker touched require intact logs, files, and screenshots.
Simple actions go a long way. Photograph the ransom note or error message with a phone. Write down the exact times of everything that was seen, and by whom. Leave the affected machine in the state IT directs, powered on or off as instructed. Note which systems the affected employee accessed recently.
Fifteen minutes of documentation during the incident preserves the timeline everyone will rely on later.
Minute 30 to 60, Communications
Silence breeds rumours. A short message to staff keeps the team calm and working. One designated person speaks to employees, and one speaks to clients and vendors. Everyone else stays quiet.
Equally important is what not to say. Do not confirm breach details before facts are known. Do not promise recovery timelines. Do not post publicly while the situation is still moving.
Canadian businesses carry an extra obligation. If personal information is involved, PIPEDA requires organizations to report to the Office of the Privacy Commissioner and notify affected individuals when there is a real risk of significant harm. Reaching that determination takes legal and IT input, which is one more reason to involve them early.
Decide These Roles Before the Emergency
Every decision above is almost impossible to make mid-crisis. A cyber incident response plan is simply these answers written down in advance, agreed to while everyone is calm.
- Who leads the response, including a backup person if the lead is travelling or unreachable
- Who calls the IT provider, with the number saved somewhere other than email
- Who handles staff communication and who handles clients, so nobody duplicates or contradicts
- What gets isolated first, and who is authorized to pull the plug
- Where the plan itself lives, because a plan stored in email and shared drives is useless when email and shared drives are the things compromised
A printed copy in a drawer sounds old-fashioned, but it is most likely to survive the incident. If your plan lives only in someone’s head, you do not have a plan.
The Peace of Mind Payoff
Businesses that rehearse the first hour recover faster, spend less, and keep client trust. The difference between panic and process is one conversation, held before it was needed, about who does what when something goes wrong.
For owners in Kelowna, Vernon, and Penticton, predictability is the real outcome. A cyber incident will always be a bad day. The combination of a documented response plan, employee awareness, and proactive security monitoring helps ensure a security event is detected and contained before it becomes a business crisis.
From Panic to Process
Don’t build your incident-response process during an incident. Talk to Carpathia IT about preparing your business before something happens. We will walk through where your response plan currently stands. Good security assumes users might not spot attacks, and the technology and your Carpathia IT team are there to help catch them.