The First 90 Seconds: How Early Decisions Shape Incident Response Investigations

This article provides guidance for incident responders, arguing that the “first 90 seconds” recur each time an investigation’s scope expands and urging consistent early actions—identify evidence of execution, preserve key artifacts, and build context—to maintain control. It highlights failures like limited backward visibility, unclear logging coverage, unfocused artifact triage, and premature closure, and encourages preparation and practice (e.g., SANS FOR508 at SANS DC Metro 2026) to build disciplined, repeatable investigations.