Problem Statement
What is the first step after detecting a cybersecurity incident?
Explanation
The first action after identifying a security incident is containment. Containment stops the attack from spreading or causing more harm. After that comes eradication of the threat, system recovery, and a review to prevent future occurrences.
