Incident Response

Incident response (IR) is the organised approach to detecting, containing, eradicating, and recovering from network security incidents. No matter how strong your preventive controls are, breaches will occur. The quality of your incident response determines whether an incident is a minor disruption or a catastrophic failure.

---

What is a Security Incident?

A security incident is any event that compromises the confidentiality, integrity, or availability of information assets. Not every security event is an incident — but every incident starts as an event.

Term	Definition
Event	Any observable occurrence in a system or network
Alert	An event flagged by a security tool as potentially malicious
Incident	A confirmed violation of security policy or a breach

Incident Severity Levels