The First 90 Seconds: How Early Decisions Shape Incident Response Investigations

"Responders make quiet decisions right away, like what to look at first, what to preserve, and whether to treat the issue as a single system problem or the beginning of a larger pattern. Once those early decisions are made, they shape everything that follows. Understanding why those choices matter (and getting them right) requires rethinking what the "first 90 seconds" of a real investigation represents."

"The "first 90 seconds" happens every time the scope of an intrusion changes. You are notified about a system believed to be involved in an intrusion. You access it. You decide what matters, what to preserve, and what this system might reveal about the rest of the environment. That same decision window opens again when you identify a second system, then a third. Each one resets the clock."

Many incident response failures stem from actions taken immediately after detection rather than from lack of tools, intelligence, or technical skill. Teams can recover from sophisticated intrusions with limited telemetry when early choices preserve options. Initial decisions determine what to examine and preserve and whether an incident is isolated or systemic. Those decision windows recur each time the intrusion scope expands, effectively resetting the response. Treating the opening phase as a single dramatic moment erodes options. Establishing direction before assumptions harden prevents loss of control and shapes the trajectory of the entire investigation.

Read at The Hacker News