What counts as an incident

A security event is anything observable that might matter for security: a failed login, a firewall block, a new administrator account. Most events are harmless. A security incident is an event, or a series of them, that actually threatens the confidentiality, integrity or availability of systems or data, or breaks security policy.

Examples of incidents:

• An employee's email account is accessed by someone else after a phishing message.
• A cloud access key is found in a public code repository.
• Ransomware encrypts files on a file server.
• A laptop with unencrypted customer data is stolen.
• An administrator account is created that nobody can explain.
• Customer data is sent to the wrong recipient by mistake.

Notice that incidents are not only attacks. Mistakes and lost devices count too, and they are handled with the same calm method.

The lifecycle

Most frameworks, including NIST's incident handling guidance, describe a cycle:

1. Preparation: plans, people, tools and practice, before anything happens.
2. Detection and analysis: noticing something, confirming it is real and understanding its scope.
3. Containment: stopping it from getting worse.
4. Eradication: removing the cause, such as malware, attacker access or the vulnerability.
5. Recovery: returning systems to normal operation safely.
6. Post incident activity: learning and improving.

In practice, the phases overlap. You may contain one system while still analysing others. The cycle is a checklist for your thinking, not a strict sequence.

Why preparation matters most

During an incident, time is short and stress is high. Decisions that are easy in calm conditions, such as who can authorise taking a server offline, who talks to customers, or where the backups are, become slow and contentious. Every minute spent finding a phone number or arguing about authority is a minute the problem grows.

That is why this first section is entirely about preparation. The next lessons build your plan piece by piece.

Your role

Whatever your job title, you have a part to play: noticing and reporting, preserving evidence, following the plan and communicating clearly. Good incident response is a team skill, and the habits in this course apply whether you are a solo administrator or part of a large security team.