Incident Response

Immediate steps after suspected compromise, including containment, evidence preservation, escalation, and recovery planning.