A number that is always answered
24/7/365. Within four rings. Every time.
Incident Response Assurance
When a cyber attack hits, the first hour decides everything.
Do you know who to call?
Incident Response Assurance gives businesses with up to 150 employees a 24/7 response line, a specialist callback within 60 minutes, and expert-guided containment. However many times you need it, for a fixed annual fee.
From £79 a month. No surprises.
NCSC Assured Cyber Incident Response
Aruga is an NCSC Assured Service Provider for Cyber Incident Response at Standard Level, giving organisations confidence that our incident response service meets the NCSC's recognised standards for quality and capability.
The problem
Most businesses have no plan for when it happens.
- Most businesses do not have a trusted number to call when an attack hits. In the moment, that absence becomes a crisis in itself.
- Speed is everything. Every minute without expert guidance is a minute the attacker uses. Panic makes that worse.
- Your IT team knows your systems. That is not the same as knowing how to contain an active attack under pressure.
- Financial and reputational damage grows with every hour of delay. The right help on the line from the start changes the outcome.
50%
of UK businesses experienced a cyber attack or breach in the past 12 months. Cyber Security Breaches Survey 2025
£7,960
average cost to a UK SME to recover from a serious cyber breach. BT / Be the Business, 2025
78%
of UK businesses have no formal cyber incident response plan in place. Cyber Security Breaches Survey 2025
£79/mo
cost of having a trusted number to call before you ever need it. Aruga Incident Response Assurance
What's included
Everything you need. Nothing you do not.
Every subscription includes all of this. No hour bank. No tiered features. No hidden extras. A complete service, ready before you need it.
A specialist calls back within the hour
60 minutes standard. 15 for high-priority.
Expert-guided containment
Up to four hours per incident. Every incident.
Unlimited incidents, all year
No hour bank. No call-out limit. No surprises.
Your incident response plan at day one
Built at onboarding. Ready before you need it.
Annual readiness check
So the plan works when it matters.
How it works
Simple. Clear. Exactly what you need at the worst possible moment.
You should never have to wonder what to do when a cyber attack hits. Click each stage to see exactly what happens.
The incident happens, any time, any day.
A cyber incident occurs. It could be a compromised credential, ransomware locking your systems, or a suspicious login at 2am on a bank holiday. It does not matter when it happens or what form it takes. What matters is that you do not need to diagnose it, find a provider, or wonder what to do. You have one number on the wall and a plan already in place.
The incident happens, any time, any day.
A cyber incident occurs. It could be a compromised credential, ransomware locking your systems, or a suspicious login at 2am on a bank holiday. It does not matter when it happens or what form it takes. What matters is that you do not need to diagnose it, find a provider, or wonder what to do. You have one number on the wall and a plan already in place.
Simple, transparent pricing
Know the cost before you ever need us.
Incident Response Assurance is designed for organisations with up to 150 employees. For larger organisations (or businesses operating internationally, in regulated sectors or critical infrastructure) we recommend Incident Response Retainer.
1. How many employees do you have?
Move the slider or type a number
employees
12550100151+
2. How would you like to pay?
3. Add Exposure Monitoring? (optional)
+£150/month
Continuous monitoring of breach data for staff credentials, plus lookalike domain alerts. Plain-English alerts when your data appears where it should not.
Your price
£220/month
£2,640 billed annually
Annual billing saves you £264 per year
Incident Response Assurance£220/month
No payment required now.
We'll call you to get started.
Please note: incident coverage begins 14 days after your subscription start date. This waiting period does not apply to the annual readiness check or onboarding.
What's included
- 24/7/365 hotline, within four rings
- Specialist callback within 60 minutes
- Up to 4 hours guided containment per incident
- Unlimited incidents throughout the year
- Populated incident response plan at onboarding
- Annual readiness check and plan review
Not included, available at pre-agreed hourly rates
- Forensic investigation and root cause analysis
- Eradication, recovery and system rebuild
- On-site attendance
- Legal, regulatory or insurance advice
- Incidents in the first 14 days of subscription
- Ransom negotiation or payment facilitation
FAQs
Frequently asked questions
Incident Response Assurance is an annual subscription giving your business immediate access to expert cyber incident responders, 24 hours a day, 365 days a year. When a cyber attack occurs, you call one number, a specialist calls you back within 60 minutes, and guided containment begins. It is the plan your business needs before an incident ever happens.
Experiencing a cyber attack right now?
Call our emergency response line, 24 hours a day, every day.
You do not need to be an existing client to call.
Cyber Compass
Not sure what your cyber risk actually looks like?
The Cyber Compass is Aruga's free cyber resilience assessment. Answer a short series of questions and receive an instant report showing where your defences are strong and where the gaps are. Takes 10 to 15 minutes. No commitment.
Get protected today
Know who to call before you ever need to.
Incident Response Assurance gives your business a complete, ready-to-use incident response capability for a fixed annual fee. No contracts to negotiate mid-crisis. No strangers to brief at 2am. Just one number and a specialist who already knows your business.
Onboarding takes minutes. Cover starts within days. From the moment you are set up, you are ready.
UK Manufacturing Company
“We had a compromised admin account and could see someone actively moving through our systems. Aruga were onto it immediately, contained the attack and then gave us a really clear root cause report and list of what we needed to fix.”
UK Professional Services Company
“Someone had got into one of our Microsoft 365 accounts and we honestly didn't know how far it had gone. Aruga worked that out quickly, shut it down and gave us a practical action plan afterwards. Exactly what we needed at the time.”