Security Incident

Any event that indicates your systems or data may have been compromised or that security measures failed. In plain terms, it's something that could spell trouble or has caused trouble in your cybersecurity.

‍

Not every suspicious event is a full-blown incident - sometimes it's a false alarm - but typically, incidents include things like confirmed malware infections, unauthorized access to a system, data breaches, or DDoS attacks causing service outages.

‍

Even a lost company laptop can be considered a security incident if it contained sensitive data. The key is that an incident is a violation or imminent threat of violation of your security policies or standard protections (for example, detection of an intruder on the network or discovery that confidential data was emailed to the wrong person).

‍

When an incident occurs, it triggers your incident response process. It's worth defining upfront what counts as an incident for your business, so your team knows when to sound the alarm.