Business Security
When every minute counts, preparation and precision can mean the difference between disruption and disaster
03 Nov 2025 • , 5 min. read
Network defenders are feeling the heat. The number of data breaches Verizon investigated last year, as a share of overall incidents, was up 20 percentage points on the previous year. This need not be as catastrophic as it sounds, as long as teams are able to respond rapidly and decisively to intrusions. But those first minutes and hours are critical.
Preparation is the key to effective incident response (IR). Although every organization (and incident) is different, you don’t want to be making stuff up on the fly once the alarm bells have begun ringing. If everyone in the incident response team knows exactly what to do, there’s more chance of a swift, satisfactory and low-cost resolution.
Once threat actors get inside your network, the clock is ticking. Whether they are after sensitive data to steal and ransom, or want to deploy ransomware or other malicious payloads, the key is to stop them before they’re able to reach your crown jewels. This is becoming more challenging.
The latest research claims that adversaries progressed from initial access to lateral movement (aka “breakout time”) 22% faster in 2024 than the previous year. The average breakout time was 48 minutes, although the fastest recorded attack was almost half that: just 27 minutes. Could you respond to a security breach in under half an hour?
Meanwhile, the average time it takes global organizations to detect and contain a breach is 241 days, according to IBM. There’s a major financial incentive for getting IR right. Breaches with a lifecycle under 200 days saw costs drop by around 5% this year to US$3.9 million, while those over 200 days cost over US$5 million, the report claims.
No organization is 100% breach-proof. If you suffer an incident and suspect unauthorized access, work swiftly, but also methodically. These five steps can help guide your first 24 to 48 hours. Be aware too that some of these steps should happen concurrently. The focus should be on speed but also thoroughness, without compromising accuracy or evidence.
The first step is to understand exactly what just happened and set to work on a response. That means activating your pre-built IR plan and notifying the team. This group should include stakeholders from across the business, including HR, PR and communications, legal and executive leadership. They all have an important part to play post-incident.
Next, work out the blast radius of the attack:
You’ll need to document every step and collect evidence not just to assess the impact of the attack, but also for forensic investigation, and possibly legal purposes. Maintaining chain of custody ensures credibility if law enforcement or courts need to be involved.
Once you’ve established what has happened, it is necessary to inform the relevant authorities.
While outreach to relevant third parties is ongoing, you’ll need to work fast to prevent the spread of the attack. Isolate impacted systems from the internet, but don’t turn off devices in case you destroy evidence. In other words, the goal is to limit the attacker’s reach without destroying valuable evidence.
Any backups should be offline and disconnected so your attackers can’t hijack them and ransomware can’t corrupt them. All remote access should be disabled, VPN credentials reset, and security tools used to block any incoming malicious traffic and command-and-control connections.
Once containment is in place, transition to eradication and recovery. Conduct forensic analysis to understand your attacker’s tactics, techniques and procedures (TTPs), from initial entry to lateral movement and (if relevant) data encryption or exfiltration. Remove any lingering malware, backdoors, rogue accounts and other signs of compromise.
Now it’s time to recover and restore. Key actions include:
Use the recovery phase to harden systems, not just rebuild them. That may encompass tightening privilege controls, implementing stronger authentication, and enforcing network segmentation. Enlist the help of partners to accelerate restoration or consider tools like ESET’s Ransomware Remediation to speed up the process.
Once the immediate danger has passed, your work is far from over. Work through your obligations to regulators, customers and other stakeholders (e.g., partners and suppliers). Updated communications will be necessary once you understand the extent of the breach, potentially including a regulatory filing. Your PR and legal advisors should be taking the lead here.
A post-incident review helps transform a painful event into a catalyst for resilience. Once the dust has settled, it’s also a good idea to work out what happened and what lessons can be learned in order to prevent a similar incident occurring in the future. Examine what went wrong, what worked, and where detection or communication lagged. Update your IR plan, playbooks, and escalation procedures accordingly. Any tweaks to the IR plan, or recommendations for new security controls and employee training tips, would be useful.
A strong post-incident culture treats every breach as a training exercise for the next one, improving defenses and decision-making under stress.
It's not always possible to prevent a breach, but it is possible to minimize the damage. If your organization doesn’t have the resources to monitor for threats 24/7, consider a managed detection and response (MDR) service from a trusted third party. Whatever happens, test your IR plan, and then test it again. Because successful incident response isn’t just a matter for IT. It requires a number of stakeholders from across the organization and externally to work together in harmony. The kind of muscle memory you all need usually requires plenty of practice to develop.
Sign up for our newsletters
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。