Security Incident Response: What Actually Happens When Your IT Team Gets the Call

• A security incident response follows six phases: detection and triage, containment, investigation, eradication, recovery, and post-incident review. Skipping any phase increases the risk of reinfection or missed attacker access.
• Attackers now move from initial access to data exfiltration in as little as 72 minutes, four times faster than the previous year (Unit 42, 2026). What happens in the first 30 minutes after detection determines the scope and cost of the incident.
• Incident response procedures should be documented and tested before an attack, not written during one.
• In over 90% of breaches, preventable gaps in visibility and controls materially enabled the intrusion (Unit 42, 2026).
• Regulatory obligations in Texas and under federal law impose strict notification deadlines that begin the moment a breach is confirmed.
• Organizations with a tested incident response plan incur costs more than 54% lower than those without one (IBM, 2025). Proactive cybersecurity services are where that preparation is built.

When a security incident is detected, a trained IT team works through six phases: detection and triage, containment, forensic investigation, eradication, recovery, and post-incident review. Each phase has specific technical tasks, communication requirements, and, in regulated industries, legal obligations running on a separate clock. The difference between an incident that costs thousands and one that costs hundreds of thousands is almost always a matter of how quickly and methodically those phases are executed.

Most business owners and operations managers never see inside a security incident response. They receive a call or a message, notice that systems are behaving strangely, and from that point, the work happens behind the scenes. What actually takes place between that first alert and the moment systems are restored is rarely explained in plain terms.

This article walks through what a real cybersecurity incident response looks like from the moment your IT team gets the call. It draws on the direct experience of CCS Horizon engineers supporting businesses across Texas and the Dallas-Fort Worth Metroplex, as well as current incident data from Unit 42, BakerHostetler, Verizon, and IBM. It covers the technical phases, the communication responsibilities, the legal deadlines that run in parallel, and the decisions that determine whether an incident stays contained or grows. For context, see our article on how long ransomware recovery actually takes.

There is a significant gap between what businesses expect from a security incident response and what actually needs to happen. Most organizations have some level of IT support, and many have security tools in place. Having tools is not the same as having a process.

When an alert fires, whether from an endpoint detection tool, a user reporting unusual behavior, or a managed IT security provider, what happens in the following minutes and hours is determined almost entirely by preparation. Organizations that have documented their incident response procedures and tested them against realistic scenarios consistently contain incidents faster, lose less data, and incur lower total costs than those that improvise.

IBM’s 2025 Cost of a Data Breach Report found that organizations with a tested incident response plan incurred costs more than 54% lower than those without one. The technology environment mattered less than the process. A business running enterprise-grade security tools without a defined response plan consistently underperformed a smaller business with modest tooling and a tested playbook.

For Texas businesses, the regulatory dimension impacts this. State and federal notification obligations impose strict legal deadlines that begin the moment a breach is confirmed, not when systems are restored.

A structured cybersecurity incident response follows six phases. Each has specific technical tasks, communication responsibilities, and, in regulated industries, legal obligations that run concurrently. Understanding them is the starting point for building a process that holds up under pressure.

Every security incident response starts with a question: Is this alert genuine?

Not every alert represents a real threat. Endpoint detection tools, SIEM platforms, and network monitoring systems generate significant noise, and a well-calibrated IT team reviews alerts that are false positives every day. The skill in triage is knowing quickly and with confidence when an alert represents an actual intrusion.

When CCS Horizon engineers receive a security alert for a client, the first steps are to determine what triggered the alert, on which system, at what time, and whether activity is still ongoing. That last point carries more weight than most people realize. An active intrusion and a historical one require different immediate actions. An attacker still moving through the network needs to be stopped before forensic work begins.

Speed matters more in 2026 than it did even a year ago. Unit 42’s 2026 Global Incident Response Report, based on investigations across more than 750 major incidents, found that in the fastest cases, attackers moved from initial access to data exfiltration in just 72 minutes, four times faster than the previous year. Waiting for a convenient moment to investigate an alert is no longer a defensible option.

Triage also establishes the severity level for the incident, which determines who is called, how quickly, and in what order. A well-structured incident response process has a clear escalation path defined before any incident occurs. CCS Horizon’s IT services for Dallas-Fort Worth businesses include defined escalation procedures as a standard component of every managed services agreement.

Containment is where most organizations make their most consequential mistakes.

The instinct when systems go down, or an alert fires, is to restore normal operations as quickly as possible. That instinct is understandable. Acting on it before containment is complete risks spreading malware to clean systems, destroying forensic evidence, and in some cases signaling to the attacker that detection has occurred.

Effective containment means isolating affected systems from the rest of the network without destroying their forensic state. It requires capturing affected system memory and disk images before any remediation work begins. It is painstaking work, and it is where the experience gap between teams that have done this before and those who have not becomes most visible.

For businesses operating across multiple sites, containment also means confirming that the incident has not already moved laterally into other locations. Unit 42’s 2026 report found that 87% of intrusions involved activity across multiple attack surfaces. Assuming an incident is contained to the system where it was detected is one of the most common and costly assumptions in incident response. CCS Horizon’s cybersecurity services include network segmentation configurations designed to accelerate the confirmation of lateral spread.

The investigation phase assembles the forensic picture of what happened. It is also the phase most commonly underestimated for both time and complexity.

Establishing how an attacker entered is often straightforward. Establishing everything they did after entry is significantly harder. BakerHostetler’s 2026 Data Security Incident Response Report, drawn from over 1,250 incidents, found that the root cause of a network intrusion could not be determined in 34% of cases. That figure reflects the challenge of investigating incidents without adequate logging.

Log analysis is the core work of this phase. Access logs, authentication logs, network traffic logs, and endpoint telemetry all need to be reviewed and correlated. For this to be useful, logs need to exist, be complete, and be retained for a sufficient period. Many small and mid-sized businesses either lack centralized logging or retain logs for too short a period. This is one of the gaps CCS Horizon’s IT security assessments most consistently identify across DFW-area businesses.

The investigation phase also drives the legal response. Organizations cannot determine their notification obligations under HIPAA, Texas Business and Commerce Code section 521.053, or SEC regulations until they know what data was accessed. For more on the timing of breach discovery, see our article on why businesses often discover breaches too late. Getting IT compliance support engaged from the earliest stages of a confirmed incident is a legal necessity, not an optional step.

A security incident response runs two simultaneous tracks from the moment a breach is confirmed. The table below shows how the technical and legal workstreams align across a typical incident timeline.

Eradication means removing the threat and ensuring the entry point is no longer used. In practice, this phase is the one most likely to be rushed, and rushing it is the most common cause of reinfection.

Eradication cannot begin until the investigation has established the full scope of the compromise. Removing malware from systems identified during triage while leaving a backdoor on a system found later in the investigation produces a false sense of resolution.

BakerHostetler’s 2026 report found that phishing accounted for 30% of incidents and unpatched vulnerabilities for 21%. If the attacker entered through an unpatched VPN appliance or a credential harvested via phishing, patching and credential rotation are core eradication steps. CCS Horizon’s approach to IT backup and recovery is built around this phase: clean, verified backups make restoration possible, but a backup is only useful if the environment being restored to has been fully cleaned first.

Recovery is the most visible phase to the business, and the one that creates the most pressure. The pressure is real. It’s also the wrong reason to shortcut the phases that precede it.

The recovery phase begins when the environment has been cleaned and verified. It involves restoring systems from the most recent clean backup that predates the intrusion, not automatically the most recent backup, which may have been taken after the attacker’s initial access. This is why backup architecture matters. Immutable or air-gapped backups provide a provably clean restore point.

Once systems are restored, they do not go straight back into production. They’re validated against known-good configurations, tested for residual malware, and brought back online in sequence. Line-of-business applications with third-party integrations require those integrations to be re-verified before handling live data.

The recovery phase also entails elevated monitoring requirements. The two to four weeks following an incident are a high-risk window. Attackers sometimes plant secondary access mechanisms in anticipation of detection. This is where CCS Horizon’s IT security services deliver consistent value that generic monitoring tools cannot replicate on their own. Software support plays a critical role in correctly restoring sequencing applications. 

The post-incident review is the least visible phase and the one most frequently deferred. It should not be.

A structured review, conducted within two weeks of returning to normal operations, should establish the full incident timeline, confirm that all attacker access has been revoked and all vulnerabilities closed, document what the response team did well and what needs to change, and update the incident response plan accordingly.

The review is a process improvement exercise, and it’s one of the clearest differentiators between organizations that handle the next incident better and those that repeat the same mistakes. The review should also assess whether the organization’s detection capabilities would have caught this incident earlier under different conditions. If the answer is yes, creating those conditions is the most important action to take from the review.

Most businesses that engage CCS Horizon after experiencing a security incident say something similar: they did not realize how much they lacked in place until it was needed.

Incident response preparedness is not a visible investment until the moment it is required. A tested incident response plan does not appear on a dashboard or produce a monthly report. It exists as a document, a set of configured tools, a set of relationships, and a shared understanding among the people who would need to act on it.

What CCS Horizon offers Dallas-Fort Worth businesses is preparation combined with the engineers who execute on it. Managed IT services engagements include incident response planning, tested backup and recovery architecture, active endpoint monitoring, and the escalation paths and communication protocols that determine outcomes in the first 30 minutes. If you want to understand where your organization stands before an incident tests it, the Security and IT Health Check is where to start.

The interactive quiz below helps business owners and IT managers gain an honest picture of their current incident-response readiness. Complete all six questions to receive a scored result and a recommended next step.

The questions below reflect what business owners and IT managers in the Dallas-Fort Worth area ask most frequently about cybersecurity incident response and what to expect from a professional response process.

1. Unit 42/Palo Alto Networks. 2026 Global Incident Response Report. Accessed August 2026.
2. BakerHostetler. BakerHostetler releases 2026 Data Security Incident Response Report: Familiar threats, new pressures. March 26th, 2026
3. Verizon. 2026 Data Breach Investigations Report. Accessed August 2026.
4. IBM Security. Cost of a Data Breach Report 2025. Accessed August 2026.
5. Mandiant/Google Cloud. M-Trends 2026 Report. Accessed August 2026.
6. NIST. Incident Response Recommendations and Considerations for Cybersecurity Risk Management. Accessed August 2026.
7. CISA. Federal Government Cybersecurity Incident and Vulnerability Response Playbooks. Accessed August 2026.
8. Texas Legislature. Business and Commerce Code section 521.053. Accessed August 2026.
9. US Department of Health and Human Services. HIPAA Breach Notification Rule. Accessed August 2026.