What happens in the first hours after a company discovers a breach?

In the first hours after a company discovers a breach, it does not improvise. It follows a plan written and practised long before anything went wrong: confirm that something real is happening, contain it so it cannot spread, and keep the evidence so the cause can be understood. Security people call this incident management, meaning monitoring and detection of security events and the execution of proper responses to them. The goal is a well-understood, predictable response to damaging events.

The routine has recognisable steps. Identification comes first: someone reports something odd or an administrator notices irregularities, an investigation begins and everyone writes into an incident log. Then containment: isolate the affected areas to limit the scope of the incident, while preserving information forensically so it can be studied later. That might be as simple as securing a server room or as complex as splitting a network into parts so a virus cannot move between them. Eradication removes the threat, for example by deleting malicious files or closing compromised accounts. Recovery restores normal operations, and a final review feeds lessons into future security decisions.

The people involved are not only technicians. A plan can call for skills outside IT, and a lawyer may be included to navigate the legal implications of a data breach.

The idea has a birthday. In November 1988, after the Morris worm spread across the early Internet, DARPA directed the creation of the CERT Coordination Center, the first organization of its kind, to give experts a central point for coordinating responses to network emergencies. In December 2020 the same spirit showed again, when security firm FireEye found it had been breached, published defenses the same day, and its investigation led to the discovery of the SolarWinds attack.