The First 72 Hours: What Happens During a Professional Incident Response

I have spoken with many executives in the aftermath of serious security incidents, and one recollection comes up with striking consistency: the confusion of the first hours. Systems behave strangely, information is incomplete, and decisions with significant consequences must be made quickly. Professional incident response teams exist to bring structure to that confusion. Understanding what they do, and when, helps organizations prepare and respond more effectively.

Hours 0 to 12: Triage and Scoping

The first priority is understanding what is happening. Responders gather initial facts: which systems are affected, what symptoms have been observed, and when they began. They establish secure communication channels, since the attacker may be monitoring corporate email. Critically, they work to preserve evidence, capturing memory, logs, and disk images before they are overwritten.

An early scoping assessment determines whether the incident is contained to a few systems or is widespread. Endpoint detection and response tools are frequently deployed across the environment at this stage, if not already present, to provide visibility.

Hours 12 to 36: Containment

Once the scope is reasonably understood, the focus shifts to stopping the spread. Containment actions may include isolating compromised hosts, disabling compromised accounts, resetting privileged credentials, blocking attacker infrastructure, and restricting network paths. In my experience, timing is a matter of judgment. Acting too early may alert the attacker before their full footprint is known, prompting them to cause damage or entrench further. Acting too late allows further harm.

Hours 36 to 72: Investigation and Eradication

With containment established, responders reconstruct the attack in detail: how the attacker gained access, what they did, which data they accessed, and whether they established persistence elsewhere. This investigation informs eradication, the removal of attacker tools, backdoors, and compromised accounts. It also provides the facts needed for regulatory notifications and legal assessments.

Running Alongside: Communication and Coordination

Throughout, technical work runs in parallel with business activities. Legal counsel guides privilege and notification obligations. Executives decide on business continuity measures. Communications teams prepare statements for employees, customers, and regulators. Insurers may need to be notified promptly to preserve coverage.

After the 72 Hours

Recovery, restoration from clean backups, and hardening continue for days or weeks. A thorough post-incident review identifies lessons to strengthen defenses.

The Bottom Line

The first 72 hours of an incident determine much of its eventual cost. Professional responders bring structure: preserving evidence, scoping, containing, investigating, and coordinating with legal and business stakeholders. I would strongly encourage organizations to establish a relationship with an incident response provider before they need one, with a retainer in place and contacts documented. When the moment arrives, hours spent negotiating contracts are hours the attacker gains.