Wargaming Insights: Cost of Ineffective Incident Response

This article models an intrusion chain with incomplete remediation using Markov chains and Monte Carlo simulations, applying a six-step TTP sequence (inspired by Lazarus’ “Contagious Interview”) to quantify how detection coverage and incident response (IR) effectiveness shape attacker success. Results show that while improving detection has the greatest impact when coverage is very low, IR effectiveness yields the largest marginal benefit when detection is partial (reducing success by roughly 22–35%), with diminishing returns at very low or very high detection. The piece advises boosting detection first when gaps are large, then optimizing IR playbooks/automation under partial coverage, and acknowledges limitations including unmodeled time-to-respond and attacker adaptation.