Trace Id is missing
Skip to main content
Microsoft Security

Microsoft Incident Response

Your first call before, during, and after a cybersecurity incident.

Intelligence-driven incident response

Strengthen your security with an end-to-end portfolio of proactive and reactive cybersecurity incident response services.

Global scale

Rely upon global incident response all day, every day, with options for onsite and remote assistance.


Take advantage of the depth and breadth of Microsoft Threat Intelligence and unique access to product engineering.


Benefit from longstanding Microsoft partnerships with government agencies and global cybersecurity organizations.

Included services

Dedicated experts work with you before, during, and after a cybersecurity incident.

Proactive incident response services

Reactive incident response services

  • Incident response

    Get global investigation and guidance—all day, every day—to help evaluate incident scope, contain cyberattacks, and restore critical systems. Services include options for onsite or remote incident response.

  • Compromise recovery

    Remove cyberattacker control from an environment, regain administrative control after a cybersecurity incident, and tactically harden high-impact controls to help prevent future incidents.

Two people sitting at a desk looking at a laptop connected to two desktop monitors

Learn how Microsoft Incident Response helped secure Albania

Dive into this story and panel discussion about the nation-state sponsored cyberattack on Albania and how Incident Response helped evict them and build back the country’s cyberdefenses.

Additional resources

Microsoft Security best practices

Get clear, actionable guidance for security-related decisions.

The Cyberattack Series

Go behind the scenes for an inside look at real-life cyberattack investigations in The Cyberattack Series.

Microsoft Incident Response team

Discover how the Microsoft Incident Response team helps customers investigate and respond to cyberattacks.

Get cybersecurity incident response services from experts

Let Microsoft Incident Response help before, during, and after a cybersecurity incident by removing bad actors, building resilience, and mending your defenses. Contact your Microsoft account executive to learn more.

Follow Microsoft