Written to be read while something is happening rather than studied beforehand. Short, imperative, and ordered by what expires rather than by what is interesting.
Chosen against what is actually happening rather than what is interesting to write. Business email compromise is the most common incident type reported, and MFA was defeated in essentially every case where it was deployed, which is why the cloud playbook spends its length on consent grants and session tokens rather than on passwords.
Edge devices and VPNs went from a small share of exploitation-driven breaches to roughly a fifth of them in a single year, and remote access is the entry point behind the large majority of ransomware intrusions where anyone could establish one. That is the fastest growing route in and the one most estates have least tooling for, so it has a playbook of its own.
These are a starting point for your own runbooks, not a substitute for them. Your estate, your authority to contain a host, and your legal obligations are yours, and a playbook that does not know them cannot be followed literally.
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
The window between the destruction sequence and encryption is minutes. If you are reading this before encryption has finished, containment is worth more than evidence.
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
The visible artifact is rarely the mechanism. Removing it and resetting the password feels like a response and frequently is not one.
An EDR alert, an unexplained process, or a user reporting something odd.
The most common alert and the one where an hour of careful work most often prevents a week of incident. Most of these are not incidents, and the goal is to establish which.
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
The evidence in these cases is more often about intent than about volume, and it is the case type most likely to end up in front of somebody who will test how it was collected.
A vendor advisory for a device you run at the perimeter, unexplained admin sessions on it, or an internal alert whose earliest source is the VPN range.
The fastest-growing intrusion route there is, and the one your normal tooling covers least. Edge devices went from a small share of exploitation-driven breaches to roughly a fifth of them in a single year, and remote access is the entry point behind the large majority of ransomware intrusions where anyone could establish one.
An unfamiliar file in a web root, a web server process spawning a shell, or outbound traffic from a machine that should only ever receive it.
A web shell is a foothold that looks like ordinary web traffic. The detection is usually a file or a process ancestry that makes no sense, and the investigation is mostly about how long it has been there.
Somebody forwarded a message to the security mailbox, or clicked the report button.
The most common trigger there is, and the one most often closed too early. The question is never whether the message was phishing. It is who else got it, who acted on it, and whether anything is still running.
An unrecognised enterprise application, a consent grant nobody remembers approving, or mail access that survived a password reset.
The cloud persistence that outlives every response most teams run. A consent grant is not a session and not a credential, so revoking sessions, resetting the password and re-enrolling MFA all leave it untouched.
An unexplained Domain Admin, directory replication by something that is not a domain controller, or a ticket that does not match any authentication.
The hardest response to pace correctly. Acting too early tells the operator you are there and achieves nothing durable; acting too late means rebuilding. Scope first, then act once, completely.
A resignation with an unusual access pattern behind it, a bulk download, or a report from a manager.
The one response where the legal and HR constraints shape the technical work from the first minute rather than at the end of it. Getting the order wrong here costs the organisation the ability to act on what you find.
A supplier says they never received it, or a bank detail change turns out to be fraudulent.
The only playbook here where the first hour is about money rather than evidence. Recall has a window measured in hours and it closes whether or not your investigation is finished, so the two run in parallel from the first minute.
A notification from a vendor, or their name in the news before their email arrives.
Somebody else had the incident and you have the exposure. The work is establishing what they held, what they could reach, and whether their access into your estate is still open, usually with far less information than you want.
A secret scanner alert, a report from a researcher, or finding a key in a public repository.
The clock started when it was published, not when you found it. Automated collection of public secrets is continuous and fast, so treat the credential as used until the logs say otherwise.
A billing alert, instances nobody created, or a provider notification about mining.
The cheapest incident to detect and the one most often misread as a finance problem. The compute is the symptom; the credential that created it is the incident, and it usually still works.
A public service is unreachable or degraded, and the traffic is not yours.
The one incident where the business impact is happening in front of everyone while you work. Restoring service and understanding the attack are separate jobs, and confusing them costs you both.
A tip-off, an anomaly nobody can explain, a ransom email, or a bad feeling somebody senior has acted on.
The umbrella playbook, for the hour before you know which of the others you are in. Its whole job is to stop you making the next hour harder: preserve what expires, establish scope, and avoid the three moves that destroy evidence.
You have evicted somebody, or believe you have, and need to be sure there is no way back in.
A hunt rather than a response. The assumption that makes it work: an operator who spent effort getting in spent effort staying in, and left more than one way back because they expected to lose the first.
Remediation is finished and somebody is about to say so in writing.
The step that is skipped most and matters most, because the sentence "we have removed their access" is the one the organisation will be held to. Absence of alerts is not evidence of eviction; it is evidence of absence of alerts.
The service desk reset a password or an MFA method for a caller, and the real user says it was not them. Or a new MFA method appeared on an account straight after a help desk ticket.
Nothing was exploited: somebody asked, and the process said yes. Groups such as Scattered Spider have made this a standard way in, and what follows the reset is usually fast: a new MFA device, a look around the identity platform, then the consoles that matter.
Sign-ins, mailbox activity or VPN sessions on the account of somebody who has left, or of a contractor whose engagement has ended.
Either the former employee still has a way in, or somebody else has found an account nobody is watching. The two look identical in the first hour, and they lead to very different conversations, so the first job is telling them apart.
A user reports a missing laptop, phone or tablet that could reach company mail, files or systems.
Usually a question you can close in minutes if the device was managed and encrypted, and a notification decision if it was not. The hour is spent cutting the device off, proving what protection it had, and writing that proof down before anybody asks for it.
AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop or something like them appears on a host where IT does not use it, or a sanctioned tool connects to an account or relay you do not own.
Legitimate remote management software is a favourite backdoor because it is signed, trusted by security tools and looks like IT at work. CISA has documented criminals using it for refund scams and for holding access to an estate. The question is not whether the software is malicious. It is whose account is on the other end.
A message to staff, executives or a public address claiming to hold your data and demanding payment, often with a sample or a file listing, while every system is running normally.
Data theft extortion without encryption is routine now: Cl0p ran a whole campaign this way through MOVEit Transfer. The claim may be true, exaggerated, recycled from an old breach or invented, and the first hour is about finding out which without replying.
A registry advisory, a vendor alert or a dependency scanner says a package version you use was malicious, or a build or a developer laptop ran an install script it should not have.
Poisoned packages steal whatever the machine can read: registry tokens, cloud keys, SSH keys and everything in the environment. The npm compromises of 2025 showed how fast that goes, with self-spreading malware that used stolen tokens to publish more poisoned packages. Assume every secret the install could read is gone.
Mail stops arriving, a site resolves somewhere unexpected, a certificate appears that nobody requested, or the registrar emails about a change nobody made.
Whoever controls DNS controls mail, web traffic and certificate issuance for everything under the domain. CISA issued an emergency directive on exactly this in 2019, after attackers changed DNS records to intercept traffic and obtain valid certificates. Treat it as an account compromise at the registrar or DNS provider first.
A researcher, a journalist or a scanner reports a storage bucket, blob container or shared link that anybody on the internet can read.
Usually a misconfiguration rather than an intrusion, which makes the first question not how they got in but who else read it. Only access logs answer that, and they are off by default on most platforms, so find out at once whether they were on.
