What happens in the first hour of a real incident

What should you not do in the first hour?

Do not reimage, rebuild or power off the affected system. Isolation through your endpoint tooling cuts the intruder's access while keeping memory and the filesystem intact, and memory is where the evidence lives in intrusions that never write anything suspicious to disk. A rebuilt host answers no questions, which means the scope of the incident becomes unknowable rather than merely unknown.

Do not communicate over the systems that may be compromised. Discussing a suspected email compromise by email, or coordinating in a chat platform tied to the identity provider under investigation, tells the intruder what you know and what you are about to do. Move to an out-of-band channel first, which requires having agreed one beforehand rather than inventing one during the call.

Do not start remediating piecemeal, and do not engage external help before checking your policy. Resetting one password while several sessions remain live, or blocking one address while access persists through another route, alerts the intruder without removing them and commonly triggers destructive behaviour. Many cyber policies also require notification within a stated period and require forensic and legal support to come from an approved panel, so calling a familiar supplier first can affect cover.

What actually happens in the first hour?

A signal becomes a judgement about scope. The work is answering three questions provisionally: which identities and hosts are involved, how far back does the evidence go, and is data or availability the immediate threat. None of them will be answered fully in an hour, and the value of the hour lies in getting good enough answers to make the containment decision rather than in resolving anything.

Three workstreams start at once, and the common failure is running them sequentially. Technical triage establishes scope and preserves evidence. Business decision-making decides what impact is acceptable and authorises containment. Legal and communications establish which obligations may apply and prepare for the possibility of external notification. The second one is the bottleneck almost every time, which is why the named authoriser matters more than any tool.

One person should also be recording, from the beginning, in a single timeline with timestamps: what was observed, what was decided, by whom, and what action was taken. This is dull work under pressure and it is the difference between a defensible incident and an argument three weeks later about what happened. It will also be requested by insurers, regulators and customers.

What does the first hour look like by workstream?

Roughly this shape, adjusted for your estate. The point of writing it down in advance is that at 3am nobody constructs a parallel plan, they do the next obvious thing in front of them.

Contain now or watch?

Contain immediately when the plausible next step is destructive or irreversible. Indicators associated with the run-up to ransomware, meaning credential theft on a server, backup systems being accessed or deleted, wide-scale administrative activity or security tooling being disabled, do not justify patience. In those cases the cost of tipping off the intruder is smaller than the cost of another hour of their access.

Watching is defensible only in narrow circumstances: the access appears limited, evidence collection is materially improving your understanding, and someone with authority has explicitly accepted the risk with a time limit on it. It should never be the default that arises because nobody wanted to make the call. If you are watching, the reason and the review time belong in the timeline.

The mechanics of containment differ by scenario in ways worth knowing before the hour arrives. For stolen sessions, credential resets are insufficient on their own because existing sessions and refresh tokens outlive them, so revocation is the action that matters. For cloud credentials, restrict the identity first and review what it did before deleting it. Deletion does not erase the recorded activity, since AWS CloudTrail event history and the Entra ID sign-in and audit logs survive the principal and can still be searched by the deleted name, but it does destroy the identity's configuration, meaning its attached and inline policies, keys and trust relationships, and it makes clean attribution of those recorded events harder. For containers, removing the pod from service while keeping it, and suspending replacement, is the equivalent of isolating a server.

Which clocks start in the first hour?

More than most teams realise, and several before scope is understood. Where personal data is involved, data protection regimes in the UK, EU and elsewhere impose a notification period to the supervisory authority measured in tens of hours from becoming aware, with separate duties towards affected individuals. Entities in scope of sector-specific regimes may have an early warning duty measured in hours and staged follow-up reports. Listed companies in some markets have disclosure duties tied to materiality assessments. Financial services entities in the EU have their own staged reporting timetable.

The specifics depend entirely on where you operate, what sector you are in, and what your customer contracts say, and several instruments in this space have changed recently. That is exactly why the runbook should name the person who determines applicability rather than summarise the rules. The purpose of knowing they exist is that the clock generally starts at awareness, not at the end of the investigation, so a team that waits for certainty before involving anyone has usually consumed a meaningful portion of the available time.

Two commercial clocks run alongside the regulatory ones and are often shorter. Cyber insurance policies typically require prompt notification and use of approved providers, and customer contracts frequently contain notification commitments tighter than any statute. Both are knowable in advance from documents you already hold, and neither should be read for the first time during an incident.

What decides whether the hour goes well?

Three things, all prepared in advance and none of them technology. A named decision-maker who is reachable at night and knows they are named. An out-of-band communication channel that already exists. And written pre-authorisation for specific containment actions, so the responder can act rather than wait. Organisations with those three consistently handle their first hour better than organisations with better detection and none of them.

The test is available now and takes ten minutes. Call your own out-of-hours escalation path as though you were an analyst with a confirmed compromise, and time how long it takes to reach a person who can authorise disconnecting a production system. Then ask that person whether they know they hold that authority. The gap between the answer you expect and the answer you get is the most useful finding in this whole cluster.

Run the same test on the insurance and counsel path, since it is the one nobody rehearses. Find the policy, find the notification requirement and the panel provider list, and confirm who holds that relationship. Doing it on a quiet afternoon converts the most avoidable category of first-hour mistake into a phone number somebody already has.