Home / Knowledge hub / Security incident
Knowledge hub
Security incident
An event that actually harms, or threatens to harm, your data or systems.
What it means
A security incident is an event that actually or potentially jeopardises the confidentiality, integrity or availability of a system or the information it holds, or that breaks your security policy. NIST defines it in close to these words. The key word is potentially: harm does not have to have happened yet.
Not every alert is an incident. A failed login is an event. Ten thousand failed logins followed by a success from a new country is the kind of pattern that may become one. The word marks the point where someone has to decide, record and act.
Why it matters
Naming an incident starts things that cost money and time: people are pulled in, notifications may be due, and customers may need an explanation. If nobody has agreed what counts, the call is made in a panic, usually too late.
Clock-based rules make the decision matter. Some regulations count from the moment you become aware of a data breach, and a few set time limits as short as hours. A team that debates the definition for two days has already lost most of that time.
How it shows up
You meet incidents as an alert from monitoring, a customer message, a researcher's email, a lost laptop, or a vendor telling you they were breached. Many come from ordinary causes such as a misconfigured storage bucket rather than a dramatic attack.
The repeated mistakes are having no clear way to report one, no named owner, and no agreement on when an event is promoted to an incident. Write down who can declare one, who is told, and where it is recorded. Then link it to your incident response plan.
Questions people ask
Security incident, answered
What is the difference between an event and an incident?
An event is anything observable in a system, such as a login or a file change. An incident is an event, or a group of them, that harms or threatens security.
Most events are normal. The task of monitoring is to spot the few that are not.
Is every data breach an incident?
Yes, a data breach is a kind of security incident. But many incidents are not breaches, for example a service taken offline by an attack or malware found before any data left.
Breaches often carry extra legal duties that other incidents do not.
Who decides that something is an incident?
Decide this in advance. Many teams give an on-call person or a security lead the authority to declare one, with a rule that anyone can raise a concern.
Waiting for senior approval before you name it usually wastes time.
Does a vulnerability count as an incident?
Not by itself. A vulnerability is a weakness. It becomes an incident when it is exploited, or when there is evidence that someone is trying.
Finding a flaw during testing is a finding, not an incident.
What should we record about an incident?
The time it was noticed, who found it, what is affected, what was done and when, and who was told. Keep notes as you go rather than from memory afterwards.
These records feed the post-incident review.
Sources
Where this comes from
Related
Terms that sit next to this one
Incident response
The agreed plan for the hours after something has gone wrong.
Incident response plan
A written plan for who does what in the first hours after a security incident.
Data breach
Information you hold ends up somewhere it should not be.
Incident severity levels
Agreed tiers that decide how fast and how widely an incident is escalated.
Containment
Limiting an incident's spread first, before the clean-up starts.
Would a test have caught this first?
Many incidents begin with a flaw nobody tested. We find vulnerabilities in web apps and APIs and prove them, so you fix the weakness before it becomes an event. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.