Incident Response: What Happens After the Alarm Goes Off
An alert is only the beginning. Incident response is the calm, repeatable process that carries a team through what comes next.
2 min readIntermediate Sep 4, 2026
Explain Like I'm Not a Hacker
It's a fire drill for computers: everyone already knows their job, the fire gets contained first, and only afterwards does anyone work out how it started.
The 30-second explanation
When something goes wrong, a good team doesn't panic. It follows a plan: confirm what happened, stop it spreading, clean things up, get back to normal, then learn from it.
How it works
- 1
1. Prepare
Plans, contacts, tools and practice, all set up in advance.
- 2
2. Detect & analyse
Confirm the alert is real and work out how far it reaches.
- 3
3. Contain & remove
Stop it spreading, then remove the cause behind it.
- 4
4. Recover & learn
Restore safely, then improve something before closing it out.
The work starts long before any incident: contacts, tools, backups and practice runs, all in place ahead of time. When an alert arrives, analysts confirm whether it's real and how far it reaches. Containment limits the damage, often by isolating machines or disabling accounts. Eradication removes both the attacker's access and whatever let them in. Recovery brings systems back safely rather than quickly. Afterwards, the team writes down what happened and changes something concrete, so the same route in is harder to use next time.
Real-world example
An alert shows one laptop contacting an unfamiliar server. The team isolates it, finds the same connection on a second machine, disables the affected account, removes the malicious software, restores normal service, and later adds a detection so the same pattern gets caught sooner.
How to spot it
No one knows who is in charge
Confusion about roles slows down every step that follows.
Fixing before understanding
Rebuilding a machine before anyone finds out how it was actually breached.
Evidence lost
Logs overwritten, or devices wiped clean too early to learn anything.
No follow-up
The same incident repeats later because nothing structural actually changed.
What to do
- 1Write down who does what, and keep contact details somewhere reachable even during an outage.
- 2Contain first, but preserve logs and evidence before rebuilding anything on top of them.
- 3Hold a short review after every incident, and record the specific changes you're going to make.
Stay curious. Stay safer.
This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.