The first hour of a suspected security breach is among the most consequential in the entire incident lifecycle. Decisions and actions taken in that hour often determine whether the incident is contained quickly or escalates into a major event. After participating in dozens of incident responses, here are the 6 steps that should happen in the first hour, what each accomplishes, and the common mistakes that complicate later phases.
Step 1: Verify the alert (5-15 minutes)
The first action is determining whether you actually have an incident or a false alarm. Many security alerts are false positives; acting on every alert as if it's a real incident wastes resources and produces alert fatigue.
What to do: review the source data for the alert. Look at the actual logs, network traffic, or behavior that triggered the alert. Determine whether the alert reflects real malicious activity.
What to avoid: immediately escalating without verification. Mass-paging the IR team for every alert produces fatigue that slows real incidents.
If real: proceed to Step 2 immediately.
If false: document the false positive, tune the detection if possible, return to normal operations.
Step 2: Activate the response team (5-10 minutes after verification)
Once an incident is confirmed, the right people need to be involved quickly. The composition depends on the incident type but generally includes security, IT operations, communications, and legal.
What to do: activate the incident response team according to your IR plan. Establish a coordination channel (war room, dedicated chat channel, conference bridge). Assign a lead incident commander.
What to avoid: ad-hoc coordination through whatever channel happens to be convenient. Multiple uncoordinated investigation streams produce confusion and missed evidence.
Step 3: Begin containment (10-30 minutes after activation)
Contain the immediate damage while investigation continues. Containment may include isolating compromised systems, suspending compromised accounts, blocking malicious network traffic, or other actions specific to the incident type.
What to do: implement containment actions based on what's known about the incident. Document each action taken with timestamp and rationale.
What to avoid: destroying evidence in the rush to contain. Some containment actions (like reformatting infected systems) eliminate forensic evidence needed for full investigation. Balance containment urgency against evidence preservation.
The hard tradeoff: containment versus visibility. Aggressive containment may stop the attack but also alert the attacker. In some cases, controlled monitoring while preserving access is more valuable than immediate containment.
Step 4: Preserve evidence (parallel with containment)
Evidence preservation supports later investigation, regulatory response, and potential legal proceedings. Evidence destroyed in the early hours can't be recovered later.
What to do: capture system images of affected systems before any modification. Preserve relevant logs (memory, disk, network) before they're overwritten or rotated. Document the chain of custody for any evidence collected.
What to avoid: modifying systems before evidence capture. Common destructive actions include rebooting affected systems (loses memory evidence), deleting logs (loses audit trail), and reimaging endpoints (loses forensic data).
Step 5: Notify stakeholders (within first hour where appropriate)
Some stakeholders need to be notified immediately even when the full picture isn't clear. The notification list depends on the incident type and organizational structure.
What to notify:
- Executive leadership for incidents likely to be significant
- Legal counsel for incidents with potential regulatory or legal implications
- Affected business units for incidents affecting their operations
- External partners (incident response provider, cyber insurance carrier) per pre-established arrangements
What to avoid: over-notification that creates panic without clarity, or under-notification that leaves stakeholders unaware of issues affecting them. The IR plan should define notification thresholds and audiences.
Step 6: Establish ongoing investigation cadence (within first hour)
The incident will continue to develop. Establishing a cadence for situation updates, decision points, and team coordination prevents the response from becoming chaotic.
What to do: schedule regular check-ins (typically every 1-2 hours during active incidents). Establish documentation discipline (timestamped log of actions, observations, decisions). Designate clear roles within the response team.
What to avoid: ad-hoc continuous coordination without structured updates. The latter exhausts the team and produces incomplete documentation.
The common mistakes
Across many incident responses, the same first-hour mistakes appear repeatedly:
1. Acting before verifying
Treating every alert as a confirmed incident produces false alarms that fatigue the team and miss real incidents. Verification before activation prevents this.
2. Solo investigation
One person trying to handle the incident alone is overwhelmed quickly and can't cover all necessary streams. Activate the team early.
3. Destroying evidence in haste
Rebooting infected systems, deleting logs, reimaging endpoints — these are natural responses that destroy evidence needed for full investigation. Capture evidence before modification.
4. Over-aggressive immediate containment
Aggressive containment can alert attackers and cause them to accelerate their actions. Sometimes controlled monitoring with delayed containment is more valuable.
5. Inadequate documentation
Actions taken without documentation can't be retraced. Documentation discipline starts immediately, not after the incident is resolved.
6. Premature external communications
Communicating with customers, partners, or media before the situation is understood often creates more problems than it solves. Hold external communications until the situation is clearer.
7. Skipping legal involvement
Legal counsel should be involved early for incidents with potential regulatory or legal implications. Decisions made without legal input often need to be revisited.
The pre-incident preparation that helps
Most of what makes the first hour go well is preparation done before any incident:
- Documented IR plan with clear procedures
- Established team with defined roles
- Tabletop exercises that practice the procedures
- Pre-arranged relationships with external IR providers
- Cyber insurance coverage with response support
- Clear communication channels and contact lists
- Forensic tools and capability available before they're needed
Organizations with this preparation move smoothly through the first hour. Organizations without it spend the first hour figuring out what to do, while the incident continues to develop.
The handoff to extended response
The first hour transitions into ongoing response. The handoff should preserve everything established in the first hour while expanding to broader investigation, eradication, recovery, and lessons-learned phases.
The first-hour documentation, evidence, and notifications become the foundation for the rest of the response. Strong first-hour work makes the rest of the response more effective; weak first-hour work makes everything harder.
The mental discipline
The first hour of an incident is stressful. Stress produces shortcuts that often complicate later phases. The discipline to follow the procedure even under stress is what distinguishes mature IR teams.
Specific mental practices that help:
- Slow down deliberately. Faster decisions are usually worse decisions in IR.
- Document everything as you go, not after.
- Verify before acting. Assumptions in IR are expensive.
- Consult others. Peer review of major decisions catches mistakes.
- Take breaks. Fatigue produces errors.
The takeaway
The first hour of an incident is the foundation for everything that follows. The 6 steps above — verify, activate, contain, preserve, notify, establish cadence — should happen in essentially every incident.
For organizations whose IR capability hasn't been tested recently, a tabletop exercise simulating the first hour reveals the gaps. The investment in fixing those gaps before they're needed is much smaller than the cost of discovering them during a real incident.
