Incident response (IR) is how an organization handles a security incident from the moment it is suspected until the business is running normally again. It covers the plan written in advance, the people and outside partners named in it, and the steps taken during the incident: confirming what happened, stopping the damage, removing the attacker, restoring systems and learning from it. The goal is to limit harm and make good decisions under pressure, rather than improvising.
At a glance
- IR is a process and a set of decisions, not a single product; tools and services support it.
- It usually follows recognized phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.
- A written plan names who leads, who can authorize shutting systems down, and who handles legal, insurance and communications.
- Most mid-sized companies combine internal staff with outside help, such as an MDR provider and an incident response firm on retainer.
- Cyber insurers, auditors and customers increasingly ask to see a plan and evidence that it has been tested.
What problem it solves
Security incidents rarely arrive at a convenient time or with a clear label. A suspicious login, an encrypted file share or a vendor’s breach notice can each be the start of something serious. Without a plan, teams lose hours deciding who is in charge, whether to unplug systems, when to call the insurer, and what to tell employees and customers. Evidence gets overwritten, attackers keep their access, and systems restored too early get reinfected.
Incident response replaces that confusion with agreed roles, decision rights and steps. It also protects the company legally and financially: insurers often expect prompt notice and use of approved firms, regulations and contracts can set notification deadlines, and a documented response supports any later claims or disputes.
How it works
Most programs follow a cycle based on widely used industry frameworks:
Preparation. Write the plan, name the team and backups, set up out-of-band communication (in case email is compromised), make sure logging and endpoint tools are in place, and arrange outside support in advance. Run tabletop exercises to rehearse.
Detection and analysis. Alerts from endpoint detection, security monitoring or a managed detection provider, or reports from employees and partners, are triaged. The team confirms whether it is a real incident, how serious it is, and what systems and data are involved, while preserving evidence.
Containment. Stop the spread: isolate affected devices, disable compromised accounts, revoke sessions, block malicious addresses. Short-term containment buys time; longer-term containment keeps the business running while the investigation continues.
Eradication and recovery. Remove the attacker’s tools and access, fix the weakness they used, reset credentials, and restore systems from known-good backups, then watch closely for signs of return.
Lessons learned. Review what happened, what worked and what didn’t, and assign fixes with owners and dates.
Throughout, someone tracks decisions and evidence, and legal counsel advises on notification duties.
When it matters for buyers
- When insurance or customers ask. Cyber insurance applications and supplier security questionnaires routinely ask whether you have a documented, tested incident response plan.
- When you rely on outside providers. If an MSP, MDR provider or SaaS vendor is part of your response, the plan needs their contacts, their responsibilities and where their job ends.
- After a near miss or a peer’s breach. These are the moments leadership is willing to fund preparation.
- When the business changes. Mergers, new cloud platforms and changes to your security providers can leave the plan pointing at people and systems that no longer exist.
Questions to ask vendors
These questions apply to any provider you’d rely on during an incident, such as an MDR service, MSP or incident response firm:
- What exactly will you do during an incident, and where does your responsibility end and ours begin?
- What are your guaranteed response times, and do they apply nights and weekends?
- What actions can you take without our approval, such as isolating devices or disabling accounts?
- Will you work with our cyber insurer, breach counsel and other providers?
- What evidence do you preserve, and what does your incident report include?
- Will you join our tabletop exercises and help keep our plan current?
How it differs from MDR and an incident response retainer
Incident response is the whole process your organization owns. Managed detection and response (MDR) is a service that handles one part of it continuously: 24/7 monitoring, triage and first response, such as isolating a device where you have authorized it. An incident response retainer is a contract that puts outside experts on call for the deep investigation and recovery work after a serious incident. Many companies use both, but the decisions about the business, notifications and recovery priorities stay with you. A security operations center (SOC) is the team or function that detects incidents and kicks off response. For more, see our incident response services overview and incident response checklist.
Problems this helps with
- Not knowing what to do in the first hour of a breach
- Cyber insurance or customers asking for our incident response plan
- Nobody sure who decides whether to shut systems down or call the lawyers
- Recovering from an attack without letting the attacker back in
