After an incident, analyze what happened and improve. Skip this phase and you repeat the same mistakes.
Post-incident review:
- What happened and when?
- How did the attacker get in?
- What worked in our response?
- What could be better?
Action items:
- Update detection rules
- Fix process gaps
- Improve documentation
- Address training gaps
- Implement technical controls
Documentation: Create formal report, update threat intelligence, share with peers. Schedule lessons learned within weeks while memories are fresh.