The first hour after discovering a cybersecurity incident often determines how much worse the situation becomes.
Panic, confusion, and uncoordinated action during that hour can cause as much damage as the cybersecurity incident itself.
Here is what the first hour should actually look like.
Confirm What You’re Actually Dealing With
Before reacting, take a few minutes to understand what’s actually happening: which system, account, or device appears affected, and what the first sign of trouble was.
Acting on incomplete information can lead to the wrong response, such as restoring the wrong backup or disconnecting a system that wasn’t actually involved. A few extra minutes spent confirming the basics almost always pays for itself later in the response.
Contain the Problem Before It Spreads
Once something is confirmed, the priority shifts to limiting how far it can spread.
This may mean disconnecting an affected device from the network, disabling a compromised account, or restricting access to a specific system, without necessarily shutting down the entire business. The goal is to stop the immediate spread, not to solve the underlying problem in the same moment.
Notify the Right People Immediately
Every business should already know exactly who gets contacted first: an internal decision-maker, an IT provider, and in some cases legal counsel or cyber insurance.
Waiting to notify the right people because the situation isn’t “confirmed enough yet” is one of the most common ways the first hour gets wasted. It is almost always better to make the call and learn it was a false alarm than to wait and be wrong.
Document Decisions as They’re Made
Even a short list of what was noticed, what actions were taken, and when, becomes valuable later.
This does not need to be formal. A simple running note of what happened and what was decided helps whoever reviews the incident afterward, and helps avoid confusion about what’s already been tried.
Preserve Evidence Instead of Cleaning Up Right Away
The instinct to immediately delete a suspicious file, reset every password, or wipe a device is understandable, but it can destroy information needed to understand what actually happened.
Where possible, document what’s visible, take screenshots, and let whoever is investigating decide what should be preserved before anything is removed or reset.
Avoid Making Decisions Alone
A single employee should not be left to decide, on their own, whether to pay a ransom demand, respond to an attacker, or make major system changes.
Decisions during an incident should go through whoever has been designated to make them, even if that means a short delay while the right person is reached. That short delay is almost always safer than an irreversible decision made under pressure.
Communicate Something, Even If It’s Limited
Employees, and sometimes clients, will notice that something is wrong even before an official explanation is available.
A short, honest message acknowledging that an issue is being investigated is usually better than silence, which tends to create more confusion and speculation than the incident itself. It doesn’t need to include every detail, just enough to explain why something looks different than usual.
Don’t Assume the First Hour Solves Everything
The first hour is about stabilizing the situation, not resolving it.
Trying to fully diagnose, fix, and explain everything within that window often leads to mistakes. The goal is to contain the immediate risk and set up an organized response for what comes next.
Plan Your Cybersecurity Incident Response Before You Need It.
None of these steps work well if they’re being figured out for the first time during an actual incident.
Knowing who to call, who can make decisions, and what to protect should be decided in advance, not improvised under pressure.
If your business doesn’t have a clear plan for the first hour of a cybersecurity incident, RBS IT can help you put one together before you need it.
Want more practical ways to keep your business prepared? Sign up for RBS IT Tech Tips.
