Incident Response: What to Do in the First 24 Hours of a Cyber Attack

A practical timeline for the first 24 hours of a cyber incident: detect, contain, communicate, investigate and recover.

How you respond in the first hours of a cyber incident determines its impact. This timeline follows the widely used NIST incident response lifecycle.

Hour 0-1: Detect and assemble

• Confirm the incident and record what you know, with timestamps.
• Activate your incident response plan and assemble the team: IT, security, legal, communications and leadership.
• Preserve evidence. Avoid wiping or rebooting affected systems unless needed to stop spread.

Hour 1-4: Contain

• Isolate affected devices and network segments.
• Disable compromised accounts and revoke active sessions and tokens.
• Block malicious indicators such as domains, IP addresses and hashes.
• Protect backups from being reached or encrypted.

Hour 4-12: Investigate and communicate

• Determine the entry point, scope and data affected using logs and endpoint telemetry.
• Notify your cyber insurer and legal counsel as required.
• Prepare internal and external messaging; assess regulatory and contractual notification duties and deadlines.

Hour 12-24: Eradicate and begin recovery

• Remove malware and persistence, reset credentials and patch exploited vulnerabilities.
• Restore from known-good backups and validate before reconnecting.
• Increase monitoring for signs of re-entry.

Afterward

Run a post-incident review, update the plan and fix root causes. The best time to prepare is before an incident: write the plan, assign roles and rehearse with tabletop exercises.

Explore our incident response services and managed SOC.

cyber attack responseincident response planincident response servicesransomware response