Incident Response: What Actually Happens After a Breach

Five stages, in a deliberate order

Incident response follows a consistent cycle, because skipping a stage under pressure — the most common mistake in a real emergency — tends to make things worse, not faster.

1. Detect

Before anything can be fixed, someone has to notice something is wrong — through monitoring alerts, unusual activity, or a report. This is exactly why the Security Logging and Monitoring category exists in the OWASP Top 10: an incident nobody detects simply continues indefinitely, doing damage the whole time.

2. Contain

The immediate priority is stopping the bleeding, not yet fully understanding it. Containment might mean isolating an affected system from the network, disabling a compromised account, or blocking malicious traffic — fast, decisive action to stop the incident from spreading further while investigation continues.

3. Eradicate

Once contained, the team removes the actual cause — deleting malware, closing the vulnerability that was exploited, revoking compromised credentials. This step requires understanding what genuinely happened, which is why containment buys the time needed to investigate properly rather than guessing.

4. Recover

Systems are carefully restored to normal operation, usually from clean, verified backups rather than the affected systems themselves, with extra monitoring in place to catch any sign that the problem was not fully eradicated.

5. Learn

The stage most often skipped under time pressure is also the most valuable long-term: a genuine review of what happened, how it was caught (or how it should have been caught sooner), and what changes actually prevent a repeat. Skipping this step means an organisation pays the full cost of an incident and still ends up no better protected against the next one.