Incident response and cybersecurity
We help you contain cyberattacks and restore operations.
We respond to ransomware, data breaches and account takeovers. We combine technical analysis with legal support and crisis communications. Before an incident, we test your defences and prepare your teams to act.
- 60 min
- first contact after an incident report
- 100+
- incidents handled or consulted on in 2026
- ENISA
- trusted provider of the EU Cybersecurity Reserve 2026–2028
Credibility
Experience from real incidents — including at European level.
We work on real incidents — from ransomware to data leaks — for companies and institutions in Poland, Germany, the UK and the USA.
Trusted provider
EU Cybersecurity Reserve
in a consortium with Efigo. Separately, in ENISA’s Support Action programme, we deliver preparedness services: penetration tests, incident simulations, training and consultancy.
Participation in the Reserve does not constitute an endorsement of DC9 Cyber services by ENISA.
- 100+incidents handled or consulted on in 2026
100+ incidents in 2026
That is how many incidents we have handled or consulted on this year — from ransomware to data leaks and account takeovers. We have also built software and run infrastructure, so we know systems from the inside.
Cyber Europe 2026 and Locked Shields 2026
Members of our team took part in the ENISA Cyber Europe 2026 exercise and in NATO’s Locked Shields 2026.
Services
Help during an incident. Testing and preparedness. Ongoing security support.
The scope of each service is agreed separately — the result depends on what you choose. A penetration test does not have to include a compliance analysis or a technical debt plan.
The detailed scope of every project is agreed with the client.
Incident response and digital forensics
Ransomware, a data breach, a compromised account or an intrusion — and you are not sure what to do next.
Legal support and crisis communications
You need to establish reporting obligations and talk to customers, staff or the media.
Penetration testing and red teaming
You want to know how far an attacker could get — in your application, API, infrastructure or cloud.
Tabletop exercises
You want to check whether your board and IT know what to do in the first hours of an attack.
Training
Threat awareness for staff, secure coding for developers, incident response for IT, ransomware for the board.
Security audit and compliance analysis
You are preparing for NIS2 or DORA, or want your environment configuration assessed.
More on NIS2 and DORA →
SOC and threat hunting
You do not have your own team to review alerts and look for traces of an attacker.
Vulnerability management
Scanners return hundreds of findings and it is hard to decide what to fix first.
Threat intelligence, data leak and brand abuse monitoring
You want to know which groups target your sector and whether your data or brand appear online.
Technical debt remediation
Unsupported systems and libraries, overdue updates, excessive permissions, a flat network, untested backups.
-
During an incident
Help during an incident
- When to get in touch
- Files have been encrypted, data may have leaked, an account was taken over or systems stopped working after an attack.
- What we do
- We establish the course and scope of the attack, help cut the attacker off and limit the impact, and lead system recovery. The lawyer on our team helps establish reporting obligations (GDPR, NIS2, DORA), and our communications specialist helps prepare messages for customers, staff and the media.
- What you get
- A contained incident and restored operations, evidence preserved to the agreed extent, findings on how the attack happened and recommendations that reduce the risk of a repeat. The results depend on the situation and the agreed actions.
-
Before an attack happens
Testing and preparedness
- When to get in touch
- Before a system goes live or after a significant change, before an inspection, or when you want to test the readiness of people and procedures.
- What we do
- We test applications, APIs and infrastructure within an agreed scope and verify whether weaknesses can be exploited. We run tabletop exercises on a scenario tailored to your company. We train using examples from the technologies you use. We assess environment configuration and compare your organisation against NIS2 (and national transposition) or DORA requirements.
- What you get
- Depending on the service: a report with confirmed vulnerabilities and fix priorities (test), lessons and gaps in procedures (exercise), a trained team (training), or a list of gaps against requirements with an action plan (compliance analysis).
-
Ongoing
Ongoing security support
- When to get in touch
- You do not have your own security team, or you want someone to continuously watch events, vulnerabilities and threats targeting your sector.
- What we do
- We analyse events and alerts, run threat hunting, scan your environment regularly and prioritise by real risk. We track criminal groups relevant to your sector, data leaks and brand abuse. We help plan and carry out technical debt remediation: updates, reduced permissions, network segmentation, backup restore tests.
- What you get
- Depending on the service: an agreed model for monitoring and alert response, an up-to-date list of fix priorities, warnings about threats relevant to your organisation, or a plan for and delivery of technical debt remediation.
How we work
From understanding the problem to concrete action.
We understand your needs and environment
We agree the goal, scope and constraints, and learn what matters most to your organisation.
We carry out the analysis or tests
We work on agreed material and systems, within agreed time windows.
We hand over our findings
We explain what the problems mean and how to prioritise fixes — clearly for both technical teams and management.
We help plan improvements
We walk through the recommendations. Further support and retesting are agreed depending on the project.
About us
A team that knows systems from the inside.
We combine experience in software development, infrastructure operations and incident response. This lets us understand both how systems work and the day-to-day reality of the teams responsible for them. We turn technical findings into decisions and actions that can actually be implemented.
Our founding team brings together IT specialists, a lawyer and a communications specialist. So during an incident we look not only at systems, but also at legal obligations and how the organisation talks to the outside world.
Cooperation with CERT and CSIRT teams
We work with CERT Polska, CERT.ngo and sector CSIRT teams. We share information about active campaigns and ransomware groups we see during incidents. This cooperation helps us recognise faster who our client is dealing with.
What guides us
- Trust
- Client work stays within our walls. We anonymise cases and never use project history for self-promotion.
- Clarity
- Technical teams get findings and remediation guidance; the board gets an impact assessment, priorities and decisions to make.
- Expertise
- Knowledge over ego. We base decisions on experience and take responsibility for the outcomes.
- Ownership
- We keep deadlines and honour commitments. Nothing is overstated.
- Collaboration
- We work as one team, so the client always gets the full picture.
Founding team
-
Board
Maciej Broniarz
Founder & CEO
ExpertiseIncident response and training
20+ years of experience
-
Board
Marcin Doliński
Co-founder
ExpertiseInfrastructure and vulnerabilities
20+ years of experience
-
Board
Łukasz Sobiecki
Co-founder
ExpertisePenetration testing and cloud security
20+ years of experience
-
Paweł Marcisz
Co-founder
ExpertisePolish and European law
15+ years of experience
-
Konrad Latkowski
Co-founder
ExpertiseCommunication and processes
15+ years of experience
Questions
Frequently asked questions
How fast does DC9 Cyber respond to an incident report?
We will contact you within 60 minutes of receiving your report to make an initial assessment and agree the next steps.
What incidents do you handle?
Ransomware attacks, data breaches, account and email takeovers (including BEC fraud), and intrusions into infrastructure and applications. In 2026 we have handled or consulted on more than 100 incidents.
Do I need a signed contract to get help?
No. During an active incident you do not go through a proposal process. Formalities, including a non-disclosure agreement, are agreed in parallel with the first actions.
Who do you work for?
Mainly companies and institutions in Poland, as well as organisations from Germany, the UK and the USA. Together with Efigo we are part of the EU Cybersecurity Reserve established by ENISA.
Do you also help before anything happens?
Yes. We run penetration tests and red teaming, tabletop exercises, training, security audits and compliance analyses against NIS2 and DORA, and — as ongoing support — SOC, threat hunting, vulnerability management, threat intelligence and technical debt remediation.
Contact
Let’s talk about security.
Tell us what you need — an audit, testing, training or ongoing support. We’ll reply and suggest a call.
Incident in progress?
Go to the incident report form or write to hello@dc9.io. Give a safe phone number we can call.
Report an incident