The initial signs of a security incident are rarely black and white. The first questions CISOs must ask are “Is this a real incident?” and “How should I respond?” Chris Griffith, Rich Noonan and Ryan Vela leads this discussion on the first and most critical hours of a potential incident response. While removing the attacker is obviously the end goal, security teams must first understand the nature and scope of the incident in order to identify which course of action will be most effective at removing the attacker — while at the same time balancing the risk to the organization and the disruption that the response can cause.