First hours after intrusion: an incident response action map

The first hours set the quality of the whole incident. Rushed action can hide the adversary, destroy evidence, and prolong recovery.

Declare the incident formally: decision owner, comms channel, and timeline logging. Rumors across scattered chats can harm more than the attack.

Targeted isolation beats global shutdown. Network-containing a suspect host often preserves memory evidence better than immediate power-off.

Disable suspect accounts, revoke sessions, and enforce MFA for sensitive roles—while avoiding mass changes without logging.

Coordinate external messaging with PR/legal. Inconsistent customer messages burn trust more than the incident itself.

If you lack an internal IR team, call early. Hoxy provides an incident path and critical response—delay usually compounds cost.