The First 60 Minutes of a Breach: What Actually Matters

The first hour of a confirmed breach is chaotic by nature, but a few decisions in that window matter more than everything that follows.

Contain before you investigate

The instinct to immediately understand what happened often delays the more urgent task of stopping ongoing damage. Isolate affected systems first.

Do not power off compromised systems

Powering down destroys volatile memory that often contains critical forensic evidence. Isolate from the network instead of shutting down.

Loop in legal and leadership early

Many industries have strict breach notification deadlines that start ticking from the moment of discovery, not confirmation. Legal needs to know immediately, not after the investigation wraps.

Preserve, do not clean

The urge to fix it and move on is strong, but overwriting logs or reimaging systems before evidence is collected can destroy your ability to understand, and prove, what happened.

Have this plan written down before you need it

None of this works well improvised at 2am. The businesses that recover fastest are the ones who rehearsed this before an actual incident.