Think Fast, Act Faster: Incident Response That Works
February 13, 2026
When a cyber incident strikes, the difference between calm, decisive action and chaotic cleanup often comes down to preparation.
During ANM’s recent webinar, our experts Kevin Snoddy, Cybersecurity Solution Architect, and Agustin (Augie) Lozano, Solutions Architect, shared hard-earned lessons from the field on how organizations can strengthen their incident response (IR) strategies.
This blog highlights the key takeaways, framed by the NIST Cybersecurity Framework, and offers practical guidance you can apply today.
Preparation Defines Success
Most incident response failures aren’t due to sophisticated attackers, but to unprepared organizations. Common pitfalls include:
- No clear asset inventory
- Limited or missing logging
- Weak identity and access hygiene
- No 24/7 monitoring
- IR plans that exist on paper but have never been practiced
As Kevin noted, “Preparation before detection makes or breaks incident response.”
The NIST Cybersecurity Framework in Practice
The five functional areas of NIST (Identify, Protect, Detect, Respond, Recover) provide the foundation for a repeatable and resilient IR process.
Identify
You can’t protect what you don’t know exists. Maintaining an accurate asset inventory is critical, especially in hybrid environments. Regular audits must include endpoints, workloads, applications, accounts, and data flows. Risk assessments then help you prioritize where to focus.
Protect
Protecting isn’t just blocking attacks; it’s reducing the blast radius. Over-permissioned accounts, stale credentials, and incomplete MFA deployments are recurring culprits in breaches. Regular audits, patching, hardening, and backups form the core of protection.
Detect
Detection is more than a SIEM lighting up with alerts. Effective detection means tuning signals to align with business risk and understanding what “normal” looks like in your environment. Without this, alert fatigue sets in, and critical anomalies are missed.
Respond
When an incident occurs, speed and clarity matter. Organizations that respond well have:
- Tested playbooks
- Regular tabletop exercises across IT, security, leadership, and legal
- Out-of-band communication channels
- Processes for preserving logs and forensics
Recover
Recovery is not simply getting systems back online—it’s about maturing. Post-incident reviews must capture what worked, what failed, and how to prevent recurrence. As Kevin put it, “Don’t waste the pain. Use it to get better.”
Strengthening Your IR Capabilities
Augie Lozano emphasized several strategies organizations can adopt today:
- IR Retainers: A retainer ensures rapid expert engagement during a breach. Unlike cyber insurance, which covers costs, retainers provide hands-on support when every minute counts.
- Managed Detection and Response (MDR): For organizations without 24/7 SOC coverage, MDR providers offer continuous monitoring, rapid response, and advanced threat detection at a fraction of the cost of building an internal team.
- Workshops & Readiness Assessments: Exercises like ANM’s Cyber Resilient Architecture workshop help identify gaps, refine playbooks, and strengthen cross-team coordination.
Building True Resilience
The underlying theme of the session was clear: readiness is everything. Incidents are not a matter of “if” but “when.” Organizations that build muscle memory through documentation, testing, and rehearsal respond faster, lose less, and build trust across their business.
Watch the Full Webinar
This blog only scratches the surface. To hear Kevin and Augie walk through real-world scenarios, practical recommendations, and deeper technical insights, watch the full webinar recording: Think Fast, Act Faster: Incident Response That Works.