Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
What to do, and what not to do, in the first day of a suspected security incident, before your formal incident response plan fully kicks in.
The first day of a suspected security incident is where the most consequential mistakes tend to happen, not because the technical response is hard, but because it happens under pressure, often before a formal incident response plan is fully staffed and running. Here's what the first 24 hours should actually look like.
Not every alert is an incident, and not every incident is what it first appears to be. The first step is establishing, quickly, whether this is a real security event, a false positive, or something else entirely (a misconfigured monitoring rule, a legitimate but unusual admin action). Reacting drastically to an unconfirmed alert, taking systems offline, resetting every credential in the organization, can cause more disruption than the actual incident would have, if it turns out to be a false alarm.
Once confirmed, the instinct is to immediately wipe or rebuild the affected system. Resist that instinct until you've at least captured what you can, memory, relevant logs, a disk image if feasible. Containment (isolating the affected system from the network, disabling a compromised account) and eradication (rebuilding, wiping) are different steps; doing the second before you've done the first well means you may never know how the attacker got in, which makes "are we actually safe now" impossible to answer with confidence.
If there's any chance the incident involves compromised email or chat accounts, don't coordinate the response over those same channels, an attacker with mailbox access can watch the response unfold in real time and adjust. A separate, out-of-band channel (a personal phone call, a fresh meeting link shared verbally) for incident coordination is a small step that closes an easy-to-overlook gap.
Not everything is a first-24-hours task. What's genuinely time-sensitive: stopping active data exfiltration or lateral movement, preserving evidence before it's overwritten, and determining whether there's a legal or regulatory notification clock that's already started (many breach notification laws start the clock from discovery, not from confirmation). What can wait a day: the full forensic timeline, the detailed root-cause writeup, most communications beyond the immediate response team.
Depending on the data involved and your jurisdiction, there may be a regulatory notification obligation with a real deadline, and legal counsel needs to be involved in that determination early, not brought in once the technical response is already finished. This isn't about covering the incident up; it's about making sure the organization's actual legal obligations are met on time, which requires lead time most teams underestimate.
Once the immediate fire is out, there's a strong pull to move on. The retrospective, what actually happened, how it was detected (or why it wasn't, sooner), what specifically will prevent a repeat, is where the real long-term value of an incident comes from. An incident that gets contained but never properly analyzed is a missed opportunity to close the gap that let it happen at all.
Every point above is easier if it was decided in advance rather than argued out in the moment, who has authority to take a system offline, which channel is the designated out-of-band one, who calls legal and at what threshold. That's what a written incident response plan is actually for: not a document that sits unread, but a set of decisions made calmly in advance so they don't have to be made under pressure. See our Security Consulting and Security Engineering services for help building or stress-testing yours before you need it. Two specific incident types worth their own read: business email compromise and insider threat, both need a meaningfully different first-24-hours playbook than a typical external intrusion.
Tell us about your environment and goals, we'll help you scope the right engagement.