Incident response (IR)
In security operations, incident response is the full cycle of preparing for, detecting, containing, eradicating and recovering from a security incident, and of learning from it afterwards. Preparation is the phase that decides how the others go: almost every decision that determines the cost of an incident is made before it starts.
What it is
Incident response is the process by which an organisation detects an adverse event affecting the security of its information, responds to it, contains it and recovers. It does not cover cyberattacks alone: data breaches, the failure of a critical system and malicious activity from someone inside the organisation all count.
Its aim is to reduce the impact on the organisation, protect information assets and sustain business continuity. It is organised into phases, from detection through to learning.
How it works
The published cycles agree on the shape. Preparation builds the capability: contacts, authority to act, retained specialists, logging that reaches back far enough, tested playbooks and rehearsals. Detection and analysis turns a signal into a scoped incident and answers what is affected. Containment limits the damage, first quickly and then durably, and is where the difficult trade-off lives, because isolating a host stops the bleeding and warns the attacker. Eradication removes the access, which means all of it, including credentials taken and persistence installed. Recovery restores service and watches for return. The post-incident phase turns the event into changes that get made.
The last phase is not optional paperwork in Europe. Reporting duties under NIS2 and under DORA for financial entities are built around notification within defined windows and a final report, so the record produced during the incident is the record that has to satisfy a supervisor.
What goes wrong
Partial eradication is the failure that produces the repeat incident. The team removes the malware and misses the service account whose password was recovered, the token that was issued, the mail rule, the scheduled task or the certificate the attacker enrolled. Eradication that is not preceded by a scope answer is guesswork, and scope comes from forensics.
Preparation gaps look identical across clients, and none of them is discovered at a convenient moment. Nobody knows who may authorise disconnecting a production system, so the decision waits for a morning meeting. The out-of-band communication channel is inside the domain that is compromised, so the response is coordinated on the attacker’s infrastructure. Logs exist but only for a fortnight, which is shorter than the intrusion. The retainer was signed two years ago and the contact list in it was never updated.
Where this shows up in an audit
Our engagements test the first two phases whether or not that is the stated goal. A red team exercise produces a precise timeline of attacker actions, and comparing it with what the SOC saw, when they saw it, and what they did measures detection and response against real activity rather than against a scenario. The findings that come out of that comparison are usually about preparation: missing telemetry, missing authority, missing rehearsal, in that order.