Incident Response — Glossary

The longer version

The usual phases are prepare, detect and analyze, contain, eradicate, recover and review. Preparing means having a plan, a contact list, access to the right systems, logs and backups. Containing means stopping the spread, for example by isolating machines, disabling accounts and revoking tokens. Eradicating means removing the attacker's access, including any way back in. Recovering means restoring systems carefully. The review records what happened and what should change.

The hardest part is scope: knowing what else the attacker touched. A common miss is to close the way in but leave persistent access behind, such as new accounts, app secrets or mailbox forwarding rules.

Vendor incidents put the response in your hands. When Railway disclosed unauthorized access to systems holding environment variables in October 2026, the work for customers was to decide which secrets were in its custody, rotate them at the source and check logs for any use. For CVE-2026-21589, the Atlassian flaw, the response meant patching, restricting access and looking in access logs for traversal patterns.

Write a one-page plan with names and phone numbers, keep a copy where you can reach it when systems are down, practice with a tabletop exercise, and keep a running timeline during an incident.

Where we use “Incident Response”

CybersecurityGlobalProtect CVE-2026-0257 and Ransomware
Palo Alto's GlobalProtect flaw CVE-2026-0257 went from an advisory on 13 May to ransomware intrusions by June. This timeline separates what the documents show from what sources only report or claim.
Nov 1, 2026Key term
CybersecurityExploits Overtake Stolen Passwords
Verizon's 2026 DBIR puts exploitation first at 31%, ahead of credential abuse at 13%. The rise is real, but a new category and a changed taxonomy make the gap look wider than it is.
Nov 1, 2026Key term
CybersecurityMistral Large 4 Goes Open-Weight: What the Independent Scores Support
Mistral says its open-weight Large 4 leads in defensive security, but the independent Cyber Index puts it third. Here is what the scores, the hardware needs and the dual-use risk actually support.
Nov 1, 2026
CybersecurityCISA Adds Exploited GitLab and Cisco Flaws
Two exploited flaws hit CISA's KEV catalog on 29 October, but upgrading GitLab to the 12 October builds still leaves a second CVSS 10.0 flaw open. Here's what to patch, and in what order.
Nov 1, 2026
CybersecurityZero Trust in 2026: Why Most Programs Fall Short
Most enterprises claim to be "doing zero trust," but Gartner says only 10% will have a mature program by year's end. Here's the data behind the gap.
Sep 13, 2026
CybersecurityAI Security Platforms Explained: 2026 Landscape
A March 2026 breach that took an AI agent two hours to execute helped push AI security spending toward $2.8 billion this year alone.
Sep 13, 2026

The longer version

Where we use “Incident Response”

Get the Core in your inbox.