$3D first-hour cyber incident visual showing shifting, fractured sapphire-glass panels stabilised by a titanium pillar and luminous blue containment boundary.$ $3D first-hour cyber incident visual showing shifting, fractured sapphire-glass panels stabilised by a titanium pillar and luminous blue containment boundary.$

Part of Leadership & Operational Resilience

The First Hour of a Cyber Incident

Decision authority while the incident is moving faster than certainty

HOW OUR PLATFORM WORKS FREE RESILIENCE ASSESSMENT INFO

The first containment decision arrives before certainty

A serious cyber incident rarely begins with a complete picture. Systems may still respond, people may still log in and critical services may still operate when the first credible signals appear. Yet an attacker may already be using a privileged session, supplier route or data flow that should no longer remain open.

During the opening hour, your teams may need to disable an account, isolate a server, restrict supplier access or pause data movement before investigation has established exactly what happened. Each action can reduce the incident, but it can also interrupt the business.

The defining question is therefore not only what happened. It is who may act now, which verified signals justify intervention and which operational limits apply.

The first hour becomes dangerous when evidence reaches the response team before authority does.

Why the first hour remains uncertain

Early signals are usually fragments rather than a finished diagnosis. An identity may be behaving abnormally. A supplier connection may no longer make sense. A privileged session may appear in the wrong place. Data may be moving without an adequate explanation while customer, clinical or production systems still look available.

Waiting for complete certainty can feel responsible, particularly when containment could affect revenue, care, production or public services. The same delay may give an attacker time to expand access, expose more data or make a precise response harder.

The first hour is best understood as the opening decision window rather than a literal stopwatch. Its value lies in the period when targeted action can still narrow the incident before more systems, identities and dependencies have to be treated as unsafe.

Attackers move while governance gathers

Attackers do not wait for the crisis call to finish, a supplier owner to become available or every executive to agree on the incident classification. They continue to use the access they have while your organisation is deciding what that access means.

A speed gap opens between credible concern and permission to intervene. Inside that gap, a local compromise can become a wider service, data or infrastructure event even though the security team raised the alarm promptly.

Fast detection therefore solves only part of the first-hour problem. The response also needs authority that can move at the speed of the operational risk.

An attacker can continue using access while your organisation is still deciding whether that access should remain open.

Investigation cannot be the only first hour activity

Investigation, evidence preservation and technical validation remain essential, but they cannot always finish before protective action begins. Your teams may need to investigate and contain in parallel: confirm the facts, preserve volatile evidence, restrict the most dangerous paths and protect the services that must continue.

Parallel action requires a control model that links incomplete evidence to proportionate decisions. Without that model, the response can drift towards one of two extremes: waiting too long for certainty or imposing a shutdown that causes avoidable damage.

Decision area

First hour question

Required preparation

Decision area

Signal threshold

First hour question

What evidence is sufficient to restrict access or isolate a workload?

Required preparation

A defined trigger and escalation route

Decision area

Operational impact

First hour question

Which service may degrade, and what must remain available?

Required preparation

Pre-agreed tolerances and fallback priorities

Decision area

Decision authority

First hour question

Who can approve the action if the primary decision-maker is unavailable?

Required preparation

Named authority with an out-of-hours substitute

Decision area

Dependencies

First hour question

Which suppliers, identities and shared services could be affected?

Required preparation

Current owners, contacts and critical dependencies

Decision area

Decision evidence

First hour question

What was known, considered and authorised at that moment?

Required preparation

A contemporaneous decision record

Decision latency is the hidden exposure

Many companies measure how quickly an alert is detected and investigated. Fewer measure the time between a credible recommendation and an authorised operational move.

Infrastructure teams may need to identify dependencies. Operations may ask what will stop. Legal and communications teams may assess what can be said. A supplier owner may need to be found, and the executive team may have to decide whether the available evidence justifies disruption. Every consultation can be reasonable while the combined process still outlasts the decision window.

Decision latency becomes an exposure when nobody can convert concern into action without assembling the full governance structure in real time.

Decisions that should not be improvised

The first hour often raises uncomfortable but predictable choices. Can a privileged account be disabled before every dependency is known? Can a supplier route be narrowed immediately? Can a segment or virtual workload be isolated? Can a data exchange be paused? Can a critical service enter a controlled degraded mode

Your response team should not discover the limits of its authority while malicious activity is still progressing. Decision rights, thresholds, fallback roles and acceptable disruption need to be agreed, documented and exercised in advance.

Pre-authorisation does not remove judgement. It defines where judgement can become action without waiting for a new mandate at the worst possible moment.

Established guidance treats decision authority as part of incident readiness

The UK National Cyber Security Centre's Board Toolkit says an incident-response plan should define incident severity, delegate authority for key decisions and assign responsibility for contacting internal and external stakeholders. It also warns that decision quality can deteriorate during a crisis, making clear roles and out-of-hours authority essential.

NIST SP 800-61 Revision 3 assigns oversight and high-impact decisions to appropriate executive roles while incident handlers verify the event, preserve evidence and act to limit damage. It also recommends coordinating participants through established procedures rather than designing the response during the incident.

Neither source prescribes one universal command model. Both show why authority, escalation routes and acceptable actions must be established and exercised before a high-pressure incident tests them.

Sources:

National Cyber Security Centre - Cyber Security Toolkit for Boards
https://www.ncsc.gov.uk/collection/board-toolkit/principle-d-incident-planning-response-recovery/planning-your-response-to-cyber-incidents

Computer Security Resource Center - NIST SP 800-61 Rev. 3
https://csrc.nist.gov/pubs/sp/800/61/r3/final

View more details

Close more details

The purpose of pre authorisation is not to remove oversight.
It is to make proportionate action possible inside the available decision window.

Exercises should test permission under friction

A tabletop exercise may confirm that everyone knows the plan while avoiding the conditions that make the real incident difficult. Clean information, available decision-makers, working communication channels and cooperative suppliers can turn the exercise into a rehearsal of the best case.

A meaningful first-hour exercise should introduce the friction that changes decisions: a business-critical system, incomplete evidence, an unavailable owner, a suspect communication channel, an unreachable supplier and a containment action that may disrupt an important service.

The test is not whether participants can describe the escalation path. It is whether the right person can authorise a proportionate move when the preferred path is unavailable.

The decision record begins immediately

Major containment choices may later be reviewed by executives, regulators, insurers, customers or employees. The review will benefit from a clear record of what was known, who held authority, which operational risks were considered and why the action was proportionate at that moment.

Recording the decision does not delay response when the process has been designed properly. It preserves the context that later hindsight can erase and gives subsequent recovery, communication and governance work a reliable starting point.

How our platform makes first-hour authority executable

Your executive team determines which services must continue, what disruption is acceptable and who has authority during the opening phase of an incident. Our platform provides the operational capability needed to act on that authority after prevention has been bypassed.

Ransomware Containment automatically isolates the responsible user or session when active encryption is detected. Server Intrusion Protection detects and interrupts unsafe server activity involving compromised administrator credentials before it can enable lateral movement, data theft or backup destruction. Virtual Server Protection safeguards supported VMware and Hyper-V environments against attacks at the virtual-infrastructure layer. Together, these capabilities stop malicious progression that would otherwise continue through identities, servers, data paths and shared infrastructure.

Containment is performed by our platform at the point where malicious activity is occurring. Your teams can concentrate on establishing the cause and scope, preserving essential operations, meeting reporting obligations and communicating verified facts. Earlier intervention leaves fewer identities, systems and routes available to the attacker, allowing investigation, continuity and recovery to begin from a smaller and more stable incident boundary.

Our platform makes first-hour authority executable by stopping malicious activity before one foothold becomes a wider operational crisis.

Questions your executive team should be able to answer

Who can authorise containment when the primary decision-maker is unavailable?
What evidence is sufficient to restrict access before every fact is known?
Which identities, systems, supplier routes and data flows can be narrowed immediately?
Which services may enter a controlled degraded mode, and what must remain available?
How will the decision and the evidence available at that moment be recorded?

If the answers still depend on assembling the right people after the alert, the first-hour response remains a negotiation rather than an executable control model.

See whether authority can become action

Our controlled assessment runs active ransomware-encryption scenarios with your existing security controls left active throughout. It first establishes the outcome without Ransomware Containment and then repeats the scenarios with our platform enabled, showing how containment changes what the ransomware can reach and encrypt. Lateral movement, data theft, Server Intrusion Protection and Virtual Server Protection are not tested in these scenarios; their capabilities and role within the wider platform are addressed separately in the accompanying platform presentation.

Use the result as practical evidence for the authority discussion: if encryption starts, is a containment action available, understood and executable before a broader shutdown becomes necessary?

Request your resilience assessment