The First 24 Hours After a Cyberattack

An SMB survival guide for 2026

Every small business owner has had the thought.

What would we do if it happened to us?

Not a vague “cybersecurity incident.” A real one. Employees unable to log in. Files suddenly encrypted. Customer messages not going out. Suspicious emails sent from your domain. A vendor asking if your systems have been compromised. A bank calling about unusual activity. Your team looking to you for answers you do not yet have.

That is when cyber risk stops being an IT topic and becomes a business continuity crisis.

If you want one reason this matters now, start with the scale. The FBI said the 2024 Internet Crime Report combined information from 859,532 complaints and detailed reported losses exceeding $16 billion, with phishing/spoofing, extortion, and personal data breaches ranking among the top cybercrime categories by number of complaints. FBI

For SMBs, the pressure is even more personal. Hiscox’s 2025 Cyber Readiness Report found that 59% of SMEs said they had experienced a cyber attack in the last 12 months. Hiscox Cyber Readiness Report 2025

That is why the first 24 hours matter so much. In that first day, businesses make decisions that shape the size of the damage, the speed of recovery, the quality of evidence, the credibility of communications, and sometimes the long-term reputation of the company itself.

The hard truth is that many SMBs do not fail because they lacked concern. They fail because they had concern without a plan.

The first mistake most businesses make

The first mistake is treating a cyberattack like a technical inconvenience instead of an operational emergency.

If a laptop is acting strangely, if files are inaccessible, if a mailbox starts sending messages the user never wrote, or if a remote access system behaves abnormally, leaders often hesitate. They hope it is a glitch. They wait for more certainty. They do not want to overreact.

That hesitation is understandable. It is also dangerous.

CISA’s guidance for small businesses emphasizes incident response planning precisely because organizations need a practical way to act before confusion takes over. CISA Cyber Guidance for Small Businesses

The first 24 hours are not about perfect diagnosis. They are about disciplined response.

What the first 24 hours are really about

When a cyberattack is underway or strongly suspected, the first day is about five things:

containment, evidence, communications, critical operations, and escalation.

You are trying to stop the damage from spreading, preserve enough information to understand what happened, communicate without creating more confusion, protect the parts of the business that matter most, and pull in the right outside help before the situation gets worse.

That may sound simple on paper. Under pressure, it is not.

The SMB first-24-hours model

The businesses that handle cyber incidents best are not always the ones with the most expensive tools. They are often the ones that know what happens first, who decides what, and what the business can and cannot afford to lose.

Time window	What weaker SMBs often do	What stronger SMBs do instead	Why it matters
Hour 0-2	Debate whether the issue is “really” an incident	Trigger an incident process as soon as compromise is suspected	Delay gives attackers time and expands damage.
Hour 2-6	Focus only on fixing symptoms	Contain affected systems while preserving evidence	You need both operational control and investigative clarity.
Hour 6-12	Communicate ad hoc through normal channels	Use a controlled communication plan and out-of-band options if needed	Compromised email or chat can make a bad situation worse.
Hour 12-24	Guess at impact and recovery order	Prioritize critical systems, legal obligations, and outside escalation	The first day shapes both recovery speed and business trust.

Hour 0 to 2: Assume it is real until proven otherwise

The first job is to recognize that suspicious behavior may not be random. If multiple users report unusual logins, if files are changing unexpectedly, if security tools are firing, if MFA prompts are appearing without explanation, or if systems begin failing in a pattern, act like you may already be in an incident.

This does not mean shutting down the whole company impulsively. It means shifting from ordinary troubleshooting to incident mode. Name an incident lead. Start a log of what is known, by whom, and when. Identify the most obviously affected systems and accounts. If you have outside IT, an MSP, cyber counsel, insurance contacts, or forensic support, this is when their numbers should already be easy to find.

The first two hours are about discipline, not certainty.

Hour 2 to 6: Contain first, but do not destroy the evidence

This is where many SMBs get torn between two instincts: pull the plug on everything immediately, or keep everything running while someone “takes a look.” Neither extreme is ideal in every case.

The right response is controlled containment. Isolate affected endpoints where practical. Restrict suspicious accounts. Limit remote access if it appears implicated. Pause risky connections if you believe third-party tooling or exposed services may be involved. But avoid wiping systems, reimaging machines, or deleting logs too early. Once evidence is gone, it is much harder to know what happened, how far it spread, whether data left the environment, and what confidence level recovery decisions deserve.

CISA’s broader incident response resources emphasize prevention, detection, response, and recovery as connected disciplines, not isolated actions. CISA Incident Response

For an SMB, the practical translation is this: contain the fire, but do not bulldoze the scene before you understand where it started.

Hour 6 to 12: Control the communications before the rumor mill does

Once a cyber incident touches normal operations, the information problem begins.

Employees want to know whether to keep working. Customers may start seeing service issues. Vendors may notice anomalies. Executives may want updates before the facts are stable. If corporate email or collaboration tools are potentially affected, your ordinary communication channels may no longer be trustworthy.

This is why mature response plans define communication paths in advance. Who tells staff what to do? Who talks to customers if service is interrupted? Who speaks to the bank, the MSP, cyber insurance, legal counsel, or law enforcement? Which channel will leadership use if internal email is compromised?

A business in crisis does not just need information. It needs controlled information.

Hour 12 to 24: Shift from reaction to recovery priorities

By the second half of the first day, leadership needs to start answering bigger questions.

What systems are affected? What business functions are down? Is the incident still active? Do we believe data was accessed or exfiltrated? Are backups safe? What has to come back first for the company to function in a degraded but workable state? What external reporting or notification duties may apply?

The businesses that recover fastest are usually not the ones with the prettiest plans. They are the ones that already know their minimum viable business. They know which systems support payroll, customer response, order flow, finance, identity, and core operations. They know what can wait and what cannot.

The first 24 hours are where that clarity either exists or does not.

The five decisions SMB leaders should not improvise

1. Who is in charge

Someone must own coordination. Without that, the business gets multiple unofficial leaders, fragmented updates, and duplicated mistakes.

2. What gets isolated

Containment decisions need a framework. Otherwise the company either shuts down too much or leaves too much live.

3. What gets communicated, to whom, and how

Internal confusion often compounds the technical damage.

4. What systems matter most

If every application is “critical,” nothing is. Recovery needs an order.

5. When to escalate outside

Cyber insurance, legal counsel, incident response vendors, banking partners, and law enforcement should not be afterthoughts.

What SMBs should do before they ever need this guide

The uncomfortable truth is that the first 24 hours of an incident are largely determined before the incident begins.

If your team has never practiced a response scenario, the first real event becomes the rehearsal. If your vendor contacts live only in email and email is compromised, you are already behind. If no one knows who can authorize shutdown decisions, outside counsel, customer messaging, or recovery sequencing, confusion becomes its own attacker.

CISA’s small-business guidance specifically points organizations to incident response basics for a reason: planning is not paperwork. It is speed. CISA Cyber Guidance for Small Businesses

A useful pre-incident checklist is short:

• Know who leads the incident.
• Keep offline copies of critical contacts.
• Know your minimum viable business functions.
• Test backup restoration, not just backup completion.
• Have an out-of-band communication method.
• Know who your external partners are before you need them.

Why this post should worry SMB leaders

Because cyber incidents do not arrive politely, and they do not wait for the calendar to clear.

The FBI’s latest figures show the sheer scale of internet-enabled crime. Hiscox’s SME data shows how normal cyberattacks have become for smaller businesses. And almost every public breach story eventually reveals the same pattern underneath: confusion in the early hours makes the damage worse. FBI | Hiscox Cyber Readiness Report 2025

That is why the first 24 hours matter so much.

Not because they determine everything.

But because they determine whether the business responds with discipline or with panic.

How Veriti Spottr helps

Veriti Spottr helps SMBs reduce the chance that the first 24 hours ever become a crisis by identifying external exposure, surfacing security issues that deserve priority, and turning broad cyber anxiety into a more concrete plan of action.

If your business wants a practical starting point, begin with what an attacker can already see from the outside. Then make sure your response plan is not theoretical.

Because in cybersecurity, the worst time to decide how your business will react is after it already has to.

→ Head to Veriti Spottr for more information

Follow Veriti Spottr on X

Get practical cybersecurity insights, SMB threat updates, and new blog posts.

Follow @veritispottr