What is the difference between a security alert and an incident?
An alert is a signal; an incident is a confirmed event that harms or threatens the business. A monitoring tool raises an alert when it sees something unusual, such as a PC contacting an unknown server at regular intervals. Someone then checks it: many alerts turn out to be harmless, while some reveal a real problem. When one alert, or several together, show that systems or data were actually affected, there is an incident, with an owner, a response and possibly a duty to report it. For the board, the useful numbers are incidents and how quickly alerts were checked, not the raw count of alerts. NetSenX lets your team track incidents together with the alerts behind them and their NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. reporting deadlines; deciding whether an incident is significant stays with you.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- How does a cyber incident affect the sale of a company?
- What is cyber risk appetite, and why should the board set it?
- Should the board get cyber security reports from IT or from outside?
- How do we know our IT provider is doing a good job on security?
- Who should sign off answers to customer security questionnaires?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.