Published: August 2026 | Last Updated: August 2026 | Written by: Becca Wendt, Content Coordinator at amshot
Becca Wendt is Content Coordinator at amshot, a managed IT and cybersecurity provider headquartered in downtown Oklahoma City, serving energy, professional services, and other industries across the region.
Key Takeaways
- A cybersecurity incident unfolds in phases — detection, containment, investigation, eradication, recovery, and lessons learned — not as one chaotic moment.
- Speed matters most in the first minutes and hours. The faster a threat is detected and contained, the smaller the damage.
- The single biggest factor in how an incident goes is whether the organization prepared beforehand — a written plan, tested backups, and 24/7 monitoring.
- Incident response is a team effort: IT/MSP, leadership, cyber counsel, insurance, and sometimes law enforcement each play a role.
- For information-driven firms, a well-handled incident protects not just data, but investor confidence, credibility, and the deal.
Bottom Line Up Front
A cybersecurity incident isn’t a single dramatic moment — it’s a sequence of steps that unfold over minutes, hours, and sometimes days. When an organization is prepared, that sequence is calm and controlled: the threat is detected early, contained quickly, investigated thoroughly, and recovered from cleanly. When it’s not prepared, the same event becomes a scramble — with more damage, more downtime, and harder questions afterward.
The difference between a contained event and a crisis usually comes down to what was in place before anything went wrong: a written incident response plan, tested backups, 24/7 monitoring, and a team that knows who does what.
๐ Explore amshot’s Managed IT Services
The Phases of a Cybersecurity Incident at a Glance
| Phase | What Happens | Goal |
|---|---|---|
| 1. Detection | A threat is identified — by monitoring, an alert, or a person | Catch it early |
| 2. Containment | The threat is isolated to stop it spreading | Limit the damage |
| 3. Investigation | Analysts determine what happened and how far it went | Understand the scope |
| 4. Eradication | The threat is fully removed from the environment | Eliminate the cause |
| 5. Recovery | Systems and data are restored and validated | Return to normal safely |
| 6. Lessons Learned | The event is documented and defenses improved | Prevent a repeat |
What counts as a cybersecurity incident?
A cybersecurity incident is any event that threatens the confidentiality, integrity, or availability of your systems or data. It’s a broad category, and not every incident is a full-blown breach. Common examples include:
- A ransomware infection encrypting files
- A compromised email account or stolen credentials
- A phishing attack that someone clicked
- Business email compromise targeting a wire transfer
- Malware detected on a device
- Suspicious access to sensitive documents
- Data exposed or shared with the wrong person
What matters is not the label but the response. A minor alert handled well stays minor. A minor alert ignored can become the incident everyone remembers.
Phase 1: Detection — catching it early
What happens: Something is flagged as suspicious. This might come from continuous monitoring, an endpoint detection and response (EDR) alert, a 24/7 Security Operations Center (SOC), an employee reporting a phishing email, or an unusual login. The clock starts here — and how quickly a threat is detected has an outsized impact on how much damage it can do.
Why it matters: The gap between when an attacker gets in and when they’re detected is where the real damage happens. Continuous monitoring is what shrinks that gap from weeks to minutes.
What good looks like:
- 24/7 SOC monitoring and alerting
- EDR watching device behavior in real time
- Email and cloud account breach detection
- A simple way for employees to report something suspicious
24/7 monitoring and detection are baseline scope in every amshot Managed IT Services plan.
“Daniel was fantastic. He called me and remoted into my computer and fixed the issue before it could happen to my account.”
— amshot client review
Phase 2: Containment — stopping the spread
What happens: Once a threat is confirmed, the immediate priority is to stop it from spreading. This can mean isolating an affected device from the network, disabling a compromised account, blocking malicious activity, or cutting off an attacker’s access — fast.
Why it matters: Containment is the difference between one infected laptop and an environment-wide ransomware event. The faster a threat is contained, the smaller the blast radius.
What good looks like:
- Ability to isolate a device instantly
- Rapid account lockout and credential resets
- EDR that can stop a malicious process in progress
- A team ready to act around the clock, not just during business hours
Containment is where a written, tested incident response plan proves its worth.
Phase 3: Investigation — understanding the scope
What happens: With the immediate threat contained, analysts work to understand what actually happened: how the attacker got in, what they touched, whether data was accessed or taken, and how far the incident reached. EDR and logging provide the timeline that makes this possible.
Why it matters: You can’t fully recover from — or honestly report on — an incident you don’t understand. This phase determines whether sensitive information was exposed, which matters for legal, insurance, and investor obligations.
What good looks like:
- A recorded timeline of activity across endpoints
- Clear determination of what data was and wasn’t affected
- Coordination with cyber counsel on legal and disclosure questions
- Documentation that will hold up to insurer and diligence scrutiny
Phase 4: Eradication — removing the threat
What happens: The root cause is fully removed — malware cleaned, malicious accounts closed, exploited vulnerabilities patched, and any attacker footholds eliminated. The goal is to make sure the threat can’t simply come back once systems are restored.
Why it matters: Recovering before the threat is fully removed is how organizations get hit twice. Eradication ensures you’re rebuilding on clean ground.
What good looks like:
- Complete removal of malware and unauthorized access
- Patching the vulnerability that allowed entry
- Verifying no hidden persistence remains
- Confirming the environment is clean before recovery begins
“Taylor has gone above and beyond to solve some very unique issues I was having. I can’t thank him enough for how helpful, kind, and knowledgeable he has been.”
— Mason, amshot client review
Phase 5: Recovery — returning to normal, safely
What happens: Systems and data are restored — often from immutable, tested backups — and brought back online in a controlled way. Recovery is validated to confirm systems are clean and functioning before normal operations resume.
Why it matters: This is where preparation pays off most visibly. A firm with immutable, tested backups can recover quickly and confidently. A firm whose backups were never tested discovers the problem at the worst possible time.
What good looks like:
- Restoration from immutable, verified backups
- Documented recovery objectives (RTO and RPO) guiding the effort
- Validation that restored systems are clean
- Business continuity keeping the firm operating throughout
Backup and business continuity are baseline scope in every amshot Managed IT Services plan.
“Dustin was very communicative on progress throughout the process.”
— Brandon, amshot client review
Phase 6: Lessons learned — getting stronger
What happens: After the dust settles, the incident is documented end-to-end: what happened, how it was handled, what worked, and what didn’t. Defenses are improved, gaps are closed, and the incident response plan is updated based on real experience.
Why it matters: An incident is an expensive lesson. Not capturing it wastes that cost. This phase is also where documentation supports insurance claims, compliance obligations, and future diligence.
What good looks like:
- A documented incident report
- Concrete improvements to controls and processes
- An updated, tested incident response plan
- Executive-level reporting on what changed and why
Quarterly vCIO strategic planning is included in every amshot managed plan — not an upsell.
Who’s involved during an incident?
A cybersecurity incident is a team effort. Depending on severity, the response may involve:
- Your IT team or MSP — leading detection, containment, investigation, eradication, and recovery
- A 24/7 SOC — providing round-the-clock monitoring and analyst response
- Leadership — making decisions on priorities, communication, and risk
- Cyber counsel — advising on legal, disclosure, and regulatory obligations
- Cyber insurance / broker — guiding the claims process and approved responders
- Law enforcement — in cases involving certain crimes or major breaches
- Employees — reporting suspicious activity and following guidance
The organizations that handle incidents best have decided in advance who does what — so no one is figuring out roles in the middle of a crisis.
Why preparation determines the outcome
Here’s the uncomfortable truth: the outcome of an incident is largely decided before it ever happens. For information-driven firms — like non-operating exploratory oil and gas companies — the difference is stark.
A prepared firm detects the threat early, contains it in minutes, understands exactly what happened, recovers from tested backups, and can answer investors, lenders, insurers, and attorneys with confidence. An unprepared firm loses time at every phase, faces more damage, and then has to explain why it wasn’t ready.
For a careful executive, that second scenario is the real fear — not the technology failing, but being caught flat-footed and having to explain avoidable exposure to the people whose confidence the business depends on.
The most common gaps that turn incidents into crises:
- No written incident response plan — and no clear answer to “who executes it at 10 p.m. on a Sunday?”
- No 24/7 monitoring, so threats run undetected
- Backups that exist but were never tested
- No documentation to support insurance or diligence
- Unclear roles and no rehearsed response
Be ready when investors, lenders, insurers, or attorneys start asking hard questions.
“Bradley is great. Highly responsive. Always able to address my issues quickly. Highly knowledgeable. Pleasant to work with.”
— Ann, amshot client review
Questions leaders should ask about incident response
Use these in your next leadership meeting, insurance renewal, or MSP evaluation:
- Do we have a written incident response plan — and has it been tested?
- Who executes our response at 10 p.m. on a Sunday?
- Would we detect a ransomware intrusion tonight, before encryption spreads?
- Can we isolate a compromised device in minutes?
- If an incident happened, could we determine what data was affected?
- Are our backups immutable and tested, so we could recover cleanly?
- Have we defined who is involved — IT, leadership, counsel, insurance — in advance?
- Does our cyber insurance require an incident response plan we can’t currently prove?
- Could we document the incident well enough for a claim or diligence review?
- When did we last rehearse a real incident scenario end-to-end?
How amshot helps you prepare for and handle incidents
amshot’s approach is built on a simple idea: the best incident is the one that never becomes a crisis. That means preparing before anything goes wrong, monitoring continuously, and being ready to respond calmly and completely when something does.
Baseline scope in an amshot managed plan includes:
- 24/7 SOC monitoring, alerting, and managed detection and response (MDR)
- Endpoint detection and response (EDR) with rollback capability
- Email and cloud account breach detection
- Immutable, tested backups for fast, clean recovery
- Incident response coordination with cyber counsel and insurance
- IT and security documentation so response doesn’t depend on one person
- Quarterly vCIO strategic planning framed in risk reduction and ROI
For firms with compliance or heightened security needs, the amshot Secure addition adds enhanced security awareness training, cyber vulnerability and dark web scans, cyber insurance policy support, email compliance and encryption, industry-related compliance documentation, and coordination of annual penetration testing.
For firms with an internal resource already in place, amshotAlly co-managed IT provides amshot’s monitoring, response processes, tools, Centralized Services, alignment, and strategy — without displacing the person your team already trusts.
Why leaders trust amshot:
- โ 5.0-star Google rating across 74+ reviews — read the reviews
- โ Sub-30-minute average ticket response
- โ 95% of tickets closed same day
- โ 97% CSAT
- โ 99% client retention
- โ 2025 MSP Titans of the Industry Awards Finalist
- โ 20+ years in business, 100+ years combined team experience
- โ Headquartered in downtown Oklahoma City
What amshot clients are saying
“Taylor was amazing! Took the time to answer all of our questions, show us resolutions and helped with the changes necessary to fix our problem. THANK YOU!”
— Jill
“Bradley and Taylor got my issue resolved quickly. Thanks!”
— Jim
“Quick, easy, thorough. What else could you ask for?!”
— Eric
“These gentlemen are great at what they do! It’s always a pleasure working with them.”
— Debbie
“Amazing as always!”
— Judy
๐ Read all amshot Google reviews
Frequently Asked Questions — Cybersecurity Incidents
What are the phases of a cybersecurity incident?
A typical incident moves through six phases: detection (identifying the threat), containment (stopping it from spreading), investigation (understanding what happened), eradication (removing the threat), recovery (restoring systems safely), and lessons learned (documenting and improving). Preparation is what makes each phase go smoothly.
What is a cybersecurity incident?
A cybersecurity incident is any event that threatens the confidentiality, integrity, or availability of your systems or data — such as ransomware, a compromised email account, a phishing attack, business email compromise, or exposed data. Not every incident is a full breach, but each requires a response.
What is the most important thing to do during a cyber incident?
Contain it quickly. After detection, isolating the threat — an infected device, a compromised account — is what limits the damage. Fast containment is the difference between one affected device and an environment-wide event, which is why 24/7 monitoring and a tested plan matter so much.
What is an incident response plan?
An incident response plan is a written, tested document that defines how an organization detects, contains, investigates, and recovers from a security incident — including who does what and when. It’s one of the controls cyber insurers and auditors now expect firms to have.
Who should be involved in handling a cybersecurity incident?
Depending on severity: your IT team or MSP, a 24/7 SOC, leadership, cyber counsel, your cyber insurance broker, sometimes law enforcement, and employees who report and follow guidance. The best-handled incidents define these roles in advance.
Can amshot help if we already have internal IT?
Yes. amshotAlly co-managed IT adds amshot’s 24/7 monitoring, incident response processes, and documentation alongside an existing internal resource — without displacing the person your team already trusts.
Bottom Line
A cybersecurity incident is not one chaotic moment — it’s a sequence: detect, contain, investigate, eradicate, recover, and learn. How that sequence plays out is decided largely by what was in place beforehand. A written plan, tested backups, and 24/7 monitoring turn a potential crisis into a contained, well-documented event.
For firms whose value lives in information, handling an incident well protects far more than systems. It protects the credibility and confidence that the business — and every deal — depends on.
amshot’s role is simple: prepare the plan, watch around the clock, and stand ready to respond — so if something does happen, it becomes a story about how well it was handled, not how badly it went.
๐ Read real amshot client reviews | Explore amshot’s Managed IT Services | See amshot’s Industries
Talk to amshot
๐ (405) 418-6282 | โ๏ธ help@amshot.com
