What does an incident response process look like during a security event?

Incident response focuses on contain, eradicate, and recover. Steps: - Triage and scope - Containment (limit damage) - Evidence collection - Remediation - Post-incident review Prepare with runbooks, logging, tabletop exercises, and clear communication paths.