When a breach happens, it doesn’t start with alarms blaring or sirens flashing red across the office. More often, it starts quietly. A failed login attempt. An alert someone means to check “later.” A customer email that feels slightly off.

And then the clock starts ticking.

The first 72 hours after an incident are make-or-break. In that short window, your organisation will either contain the damage or watch it spiral into front-page news, regulatory fines, and broken customer trust.

Why the early hours matter
Incidents are time bombs. The longer they linger:

– Attackers dig deeper into systems.
– Data exfiltrates undetected.
– Customers and regulators lose patience.

Think about it like a house fire. A spark caught in the first five minutes might be handled with a fire extinguisher. Leave it unchecked, and you are calling in the fire brigade while the walls collapse.

Where teams fail
It is not usually a lack of tools that makes response weak. It is the lack of muscle memory.

– Unclear ownership. Who is picking up the phone at 2am? If you don’t know, you’re already behind.
– Paralysis. Teams waste precious hours debating whether something is “serious enough” to escalate.
– Communication breakdown. PR, legal, and technical teams often act in silos, creating conflicting narratives when regulators and customers demand clarity.

The anatomy of a strong first 72 hours

1. Immediate triage. Define severity levels in advance. A phishing attempt hitting one inbox is different from a ransomware lockout across finance.
2. Contain and confirm. Shut down affected systems first, validate evidence second. Too many organisations reverse the order and lose hours while the threat spreads.
3. Cross-functional war room. Legal, PR, security, and leadership should be in one channel or room within the first few hours. No silos, no “we’ll update you later.”
4. External communication. Regulators like the EU’s GDPR require breach notification within 72 hours. Customers expect it even sooner. Silence breeds suspicion.

The long-term payoff
Teams that rehearse incident response; even with two-hour tabletop drills every quarter, respond 30 to 40 percent faster when the real thing hits. More importantly, their communication is sharper, regulators are more cooperative, and customers perceive transparency rather than chaos.

The reality check
Ask yourself today: if a breach hit right now, would your team know what to do in the next hour? The next six? The next 72? Or would you be Googling “incident response template” as attackers made themselves at home?

In incident response, confidence is not built in the moment. It is built in the drills that come before.