Also known as: IR · DFIR · security incident response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.
Most frameworks describe a similar cycle: preparation, detection and analysis, containment, eradication, recovery, and post-incident review. The phases overlap in practice — containment often begins before analysis is complete, because the cost of waiting exceeds the cost of imperfect information.
The single highest-value component is preparation done before anything happens: known contacts, pre-agreed authority to disconnect systems, retained logs, and rehearsed procedures. Teams improvising these under pressure lose hours that materially affect outcomes.
Dwell Time
Dwell time is the length of time an attacker remains undetected inside a compromised environment, measured from initial intrusion to detection.
Ransomware
Ransomware is malicious software that denies an organisation access to its own data — historically by encrypting it — and demands payment in exchange for restoring access or withholding publication of stolen data.
Threat Hunting
Threat hunting is the proactive search for attackers already present in an environment, driven by hypotheses about adversary behaviour rather than by alerts from automated detection tools.
SIEM
A SIEM (Security Information and Event Management) system centralises log and event data from across an organisation's infrastructure, correlating it to detect suspicious activity and support investigation.
Tabletop Exercise
A tabletop exercise is a discussion-based simulation in which a team walks through their response to a hypothetical security incident, testing decision-making and procedures without touching production systems.