What Should an Enterprise Do in the First Hour of a Cyberattack?

MSInfo IR Team

MSInfo Services

March 11, 20257 min read

The first 60 minutes of an incident response determine whether an attack becomes a manageable security event or a catastrophic business crisis.

The first hour of a cyberattack is the most critical. Decisions made — and mistakes made — in this window determine whether an attack is contained quickly with minimal damage, or whether it spreads across the organization, exfiltrates data, and creates a crisis that takes months to recover from.

The challenge is that the first hour is also the most chaotic. Alerts are firing. Teams are confused about what's real and what's a false positive. Executives are calling for updates. Legal and communications teams are asking questions that security teams can't yet answer. In this environment, having a pre-defined, well-practiced incident response plan is not optional — it is the difference between a controlled response and a panicked reaction.

The first priority in any incident response is containment, not eradication. The temptation is to immediately start cleaning up — reimaging systems, resetting passwords, patching vulnerabilities. But acting before you understand the scope of the attack risks destroying forensic evidence, alerting the attacker that they've been discovered (causing them to escalate their activity), and missing compromised systems that you haven't yet identified.

Before any remediation action, the team needs to establish scope: what systems are affected, how did the attacker get in, where have they been, and what have they done? This requires preserving forensic evidence — memory captures, log exports, network traffic captures — before any changes are made to affected systems.

Once scope is understood, containment actions can be executed in a coordinated way. Network isolation of affected segments, disabling compromised accounts, blocking attacker C2 communications — these actions need to happen simultaneously across all affected systems, not sequentially. A piecemeal approach gives the attacker time to respond.

Parallel to the technical response, the communications response must begin. Who in leadership needs to be informed? Is there a legal obligation to notify regulators? Are customers at risk? Having pre-approved communication templates and clear escalation paths for these questions removes decision-making overhead during the most stressful phase of the incident.

MSInfo Services provides incident response planning, tabletop exercise facilitation, and active incident response support to help organizations prepare for and respond to security incidents.