What is incident response?

Incident response is the organised way a company detects, contains and recovers from a security incident, and learns from it. It covers the technical work, such as isolating machines, removing the attacker and restoring systems, and the decisions around it: who leads, who is told, when to call outside help, what to report to regulators, insurers and customers. A small company does not need a security team to do it well. It needs a short written plan, phone numbers that work when e-mail does not, someone who is allowed to make decisions at night, and evidence that shows what happened. NetSenX helps with the evidence and the timing: it detects network behaviour that often marks an intrusion, explains each alert and tracks the NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. Article 23 deadlines per incident. It does not remove attackers or restore systems.

← All 60 questions on Incident responseAll topics