← All glossary terms Glossary

What is Incident Response (IR)?

The structured process of containing, investigating, eradicating, and recovering from a security incident — ideally guided by a tested plan.

Incident Response (IR) is what happens after detection: the structured process of containing the incident, investigating its scope, eradicating the attacker, recovering operations, and learning from what went wrong. Mature organizations have a written IR plan, defined roles, and tested playbooks; less mature ones discover their plan during the incident itself, which is expensive. Many organizations now keep an IR retainer — a pre-agreed contract with a response provider — so the relationship and pricing are in place before an incident happens.