# What is incident response?

Incident response is the organised way a company detects, contains and recovers from a security incident, and learns from it. It covers the technical work, such as isolating machines, removing the attacker and restoring systems, and the decisions around it: who leads, who is told, when to call outside help, what to report to regulators, insurers and customers. A small company does not need a security team to do it well. It needs a short written plan, phone numbers that work when e-mail does not, someone who is allowed to make decisions at night, and evidence that shows what happened. NetSenX helps with the evidence and the timing: it detects network behaviour that often marks an intrusion, explains each alert and tracks the NIS2 Article 23 deadlines per incident. It does not remove attackers or restore systems.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/what-is-incident-response

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What are the phases of incident response?](https://netsenx.com/en/faq/what-are-the-phases-of-incident-response)
- [How do we prepare for a cyber incident before it happens?](https://netsenx.com/en/faq/how-to-prepare-for-a-cyber-incident)
- [What should an incident response plan contain?](https://netsenx.com/en/faq/what-should-an-incident-response-plan-contain)
- [Who should be on the incident team in a small company?](https://netsenx.com/en/faq/who-belongs-on-a-small-company-incident-team)
- [What is an incident response retainer, and do we need one?](https://netsenx.com/en/faq/what-is-an-incident-response-retainer)