Nobody thinks clearly in the first hour of discovering a breach. That's normal, and it's also exactly why having a plan written down in advance matters more than almost anything else you can do. You don't want to be making strategic decisions for the first time while also panicking.
Hour 0 to 1: Contain, don't destroy
The instinct is to shut everything down immediately. Resist it, at least for a moment. Isolating the affected systems from the network is the right move, disconnect them, don't power them off. Powering off a compromised machine can wipe volatile memory that forensic investigators need to understand what actually happened. Contain the spread, but preserve the evidence.
Hour 1 to 4: Activate your plan and your people
This is when you call your incident response team or retainer, not when you start researching who to call. Pull together the people who need to be in the room: IT leadership, a decision-maker who can authorize spending, and legal counsel if you have access to it. Begin a basic assessment of scope. What systems are affected? Is it contained to one segment, or does it appear to be spreading?
Hour 4 to 12: Bring in legal and check your insurance obligations
Most cyber insurance policies have strict notification windows, and missing them can jeopardize coverage. Legal counsel also needs to weigh in early on whether you have regulatory notification obligations, particularly if personal information may have been accessed. This is not the hour to guess; it's the hour to get the right people on the phone.
Hour 12 to 24: Communicate carefully and resist the urge to pay
Internally, give your team a clear, honest, and calm update, speculation helps nobody. Externally, resist making public statements or customer notifications until you actually understand the scope. If ransomware is involved, resist the pressure to pay immediately. Paying doesn't guarantee a working decryption key, doesn't guarantee the attacker won't leak your data anyway, and should only ever be considered alongside legal counsel and your incident response team.
The businesses that recover fastest aren’t the ones with no breach. They’re the ones who knew exactly what to do in the first hour instead of figuring it out live.
Mistakes we see most often
- Wiping or reimaging systems before forensics are complete. This destroys the evidence needed to confirm the attacker is actually gone, not just quiet.
- Paying a ransom without verifying the decryption tool works. Test it on a small, isolated subset of files first.
- Notifying customers before the scope is actually understood. An early, inaccurate statement often causes more damage than a short delay for accuracy.
- Taking a threat actor at their word. Claims about what was or wasn't stolen, or promises about deleting data after payment, come from someone with every incentive to lie.
- Making major decisions without legal counsel involved from the start. Decisions made in hour two routinely come back up in a courtroom a year later.
A written incident response plan doesn't prevent a breach. What it does is remove the guesswork from the worst day of your year, so your team is executing a plan instead of inventing one under pressure.