The Incident-Response Lifecycle and How to Rehearse It
An incident is not a moment; it is a lifecycle of six ordered phases, each with an owner and an exit condition: prepare, detect, contain, eradicate, recover, and learn. The outcome is decided in the phase nobody funds, which is preparation. Teams that improvise inside an incident lose; teams that execute a rehearsed lifecycle win. And on an AI campus the lifecycle carries a constraint the software world never faces, because you cannot power off the cooling loop or the power train to contain a threat without risking the plant. You do not rise to the occasion. You fall to the level of your training, so raise the floor deliberately with tabletops that rehearse the converged incident before an adversary does.
Knowledge check
Which phase of the incident-response lifecycle most determines the outcome, and why?
Show the answer
Preparation, because the plan, roles, pre-authorized actions, tooling, and rehearsed muscle memory established before the alarm are what let a team execute the remaining phases under pressure instead of improvising.