Rohan P.
Sample Free and genuinely useful
The communication templates alone were worth the time. Highly recommended for team leads.
Incident response basics: detect, contain and recover calmly
Prepare for security incidents, recognise them early, contain the damage without destroying evidence, recover safely and learn from every event
Created by Amara Nwosu
- Updated September 2026
- English
- Beginner
What you will learn
- Describe the phases of incident response and what happens in each
- Prepare contacts, logs, backups and playbooks before an incident
- Triage alerts and reports and assign a sensible severity
- Contain common incidents while preserving evidence
- Coordinate recovery and communication with clear roles
- Run blameless reviews and tabletop exercises that improve readiness
Course content
Preparing for the day it happens
Detection and triage
- Video: How incidents are usually discovered 9 min
- Video: Triage: is this real, and how bad? 11 min
- Article: Keeping a timeline and notes 8 min
- Video: Preserving evidence 10 min
Containment and eradication
- Video: Containing a compromised account 10 min
- Article: Containing an infected device 9 min
- Video: Leaked credentials and keys 9 min
- Video: Eradication: removing the root cause 9 min
Ransomware and major incidents
- Article: Ransomware response from the first minute 11 min
- Video: Working with outside help 9 min
- Video: Decision making under pressure 8 min
- Article: Recovering systems safely 10 min
Communication and obligations
- Video: Internal communication 8 min
- Video: Customers, partners and the public 9 min
- Article: Legal and regulatory questions 9 min
- Video: Working with your cyber insurer 7 min
Learning and practice
- Video: Blameless post incident reviews 10 min
- Article: Writing playbooks 9 min
- Video: Tabletop exercises 10 min
- Video: Measuring and improving readiness 7 min
- Quiz: Final check 6 min
Requirements
- General IT knowledge: accounts, servers, cloud services
- No security specialism required
Description
Every organisation will face a security incident sooner or later: a phished account, a malware infection, a leaked key, a ransomware attack. The difference between a bad day and a disaster is usually preparation, and how calmly and methodically people act in the first hours.
What you will learn
- The incident response lifecycle: prepare, detect, analyse, contain, eradicate, recover and learn
- What to prepare before anything happens: contacts, logs, backups, playbooks and decision rights
- How incidents are usually detected, and which signals deserve attention
- Triage and severity: deciding quickly how serious something is
- Containment that limits damage while preserving evidence
- Recovery, communication and the legal and regulatory questions to ask
- Running blameless reviews and tabletop exercises
Who it is for
This free course is for IT staff, developers on call, team leads and anyone who may be the first person to notice something is wrong. No specialist security background is needed. Larger organisations will recognise the approach from frameworks such as NIST SP 800-61; small teams will find templates they can use immediately.
We work through realistic scenarios, including a compromised email account, a leaked cloud key and a ransomware outbreak, and you finish with a one page plan and three short playbooks adapted to your environment.
Who this course is for
- IT administrators and developers who may handle incidents
- Team leads and managers who coordinate responses
- Anyone starting a career in security operations
Instructor
Amara Nwosu
Security operations engineer teaching incident response and software supply chain security
- 4.3 instructor rating
- 13 reviews
- 3,740 students
- 2 courses
- Sample
I work in security operations: building detections, running incident response and helping engineering teams secure the way they build and ship software.
My courses focus on the defender's side of the table. We look at how incidents unfold, which logs and signals reveal them early, how to contain damage calmly and how to recover without losing evidence. On the engineering side, I teach dependency hygiene, SBOMs, signing and build pipelines that are hard to tamper with.
I like checklists, runbooks and tabletop exercises, because preparation is what makes the difference when something goes wrong at three in the morning. Every course ends with templates you can adapt for your own team.
Student reviews
Gemma R.
Sample Exactly what our small team needed
We had no plan at all. The one page plan template and three playbooks gave us a solid start in an afternoon.
Felipe A.
Sample Calm and practical
The emphasis on preserving evidence and keeping a timeline changed how I handle alerts on call.
Lina B.
Sample Clear roles and severity levels
Defining an incident lead and a simple severity scale made our last incident much smoother.
Annika L.
Sample Great tabletop guidance
We ran our first tabletop exercise using the format from the course. It exposed outdated contacts immediately.
Tunde O.
Sample Ransomware section is sobering
Protecting backups and separate credentials were the key takeaways. Very clearly explained.
Jessica M.
Sample Good, quite general
Solid foundation, though experienced responders will want more technical depth on forensics.
Keep exploring
All Security Fundamentals courses
More in Security Fundamentals
Free
Enroll now