The first hour of an incident decides the next month.
What you do in the first sixty minutes of a security incident shapes how long it lasts and what it costs. A plain first-hour plan — who decides, what to contain, what not to touch, and who to call.
It is 09:12 on a Tuesday. A colleague says their files have strange names. Or the bank calls about a payment you didn’t make. Or an alert arrives about a sign-in from a country where nobody works.
What happens next is mostly decided by what happens in the next hour. Good intentions do a lot of damage in that hour: the laptop that gets wiped before anyone looks at it, the passwords reset in a way that warns the attacker, the email about the incident sent from the mailbox that has been compromised. None of it is careless. It is what people do when nobody told them what to do.
Minutes 0–10: name who is in charge
The first decision is who makes the decisions. One person leads the incident, with a deputy. Everyone else reports to them, and nobody acts alone — however obvious the fix looks.
Then move the conversation somewhere the attacker can’t read it. If email or chat may be compromised, use phones. Keep a short list of numbers on paper for exactly this moment.
Minutes 10–30: contain, don’t clean
The goal of the first half hour is to stop the damage spreading, not to repair it.
- Isolate, don’t switch off. Disconnect the affected device from the network — unplug the cable, turn off the Wi-Fi — but leave it powered on. What is in its memory can show how the attacker got in.
- Disable the account, don’t delete it. A disabled account stops the misuse and keeps the record of what it did.
- Stop the money. If payments are involved, call the bank at once. Speed is everything with fraudulent transfers.
- Keep the logs. Some systems keep them for days, not months. Make sure nobody’s cleanup erases them.
What you don’t do matters as much. Don’t wipe and rebuild yet. Don’t reset every password at once from a machine you can’t trust. Don’t tell the whole company in an email.
Minutes 30–60: call the people you’ll need
Most businesses call their insurer last. It should be one of the first calls. Many cyber policies require prompt notice, and some only cover the specialists they approve — calling someone else first can put the claim at risk. Your insurer can also put a response team in front of you within hours.
Call your lawyer early as well. They will know whether you have a duty to notify customers or regulators, and how quickly — and conversations about the incident held through them may be better protected.
Then call your technology partner, with the incident lead on the line, so what they do is decided rather than improvised.
Write it down as it happens
From the first minute, one person keeps a timeline: what was noticed, when, what was decided, by whom and why. It feels like a distraction in the moment. Afterwards it is what your insurer, your lawyer and any regulator will ask for first — and it is the only reliable account of what really happened in the order it happened.
Rehearse it on a quiet day
A first-hour plan works only if people have seen it before they need it. Two habits make the difference:
- A one-page card. Who leads, who deputises, the phone numbers — insurer, lawyer, bank, technology partner — and the containment steps. Printed, because the incident may take your files with it.
- An exercise twice a year. Ninety minutes around a table, walking through a realistic scenario: a phished mailbox, a ransomed server, a fraudulent payment. Every exercise finds something missing from the card.
The businesses that recover quickly aren’t the ones with the most tools. They are the ones where, at 09:12 on a Tuesday, everyone already knows who to call.