Cybersecurity incident response playbooks
Scenario-specific defensive guidance for the first minutes, first hour and first day of an incident, with evidence-preservation priorities, decision points, communications and explicit limits on what Cybatar itself can claim to do.
Turn a response plan into an executable sequence
These playbooks are first-party operational aids. They are not a substitute for organisation-specific procedures or qualified incident-response, legal, privacy, insurance or regulatory advice.
Phishing & Business Email Compromise Response
Protect the affected identity and business process first: preserve the suspicious message and authentication evidence, contain the affected account, revoke risky sessions or tokens, verify payment or data-change requests through an independent channel, identify related messages and accounts, and record every containment and recovery action in one incident timeline.
Open playbook → Defensive playbookCredential Compromise Response
Contain access before investigating deeply: preserve authentication evidence, revoke active sessions and exposed tokens, rotate compromised credentials or secrets, confirm approved MFA and recovery methods, identify what the identity accessed or changed, and monitor for continued activity after containment.
Open playbook → Defensive playbookRansomware Response
Prioritise safety, isolation and coordinated command. Isolate affected systems using approved procedures, preserve evidence before destructive cleanup where feasible, protect backups and privileged identities, establish an incident commander and clean communications channel, scope the affected environment, and recover only from known-good systems and data after the intrusion path is understood.
Open playbook → Defensive playbookWeb Application Incident Response
Stabilise the application without destroying evidence: preserve web, application, WAF, database, identity and deployment logs; contain the affected application or attack path; rotate exposed secrets; identify unauthorised code, configuration or data changes; remediate the root cause; and return the service to production under heightened monitoring.
Open playbook → Defensive playbookVulnerability Exploitation Response
Treat confirmed exploitation as an incident, not a patch ticket. Identify affected assets and exposure, apply the fastest safe containment or compensating control, preserve evidence of exploitation, review for persistence and follow-on access, remediate the vulnerability, and validate recovery before closing the incident.
Open playbook → Defensive playbookCloud Account Compromise Response
Contain the identity and preserve the control-plane evidence first. Revoke sessions and exposed keys, protect privileged accounts, preserve cloud audit and identity logs, review IAM and resource changes, identify data or service impact, rotate secrets, remove persistence, and restore only the permissions and resources that are known to be authorised.
Open playbook →Incident Response Checklist
Declaration, containment, scoping, evidence, recovery, communications and lessons learned in one coordination checklist.
Open checklistEvidence Preservation Checklist
Protect source metadata, integrity, custody and time-limited evidence before routine cleanup or recovery removes it.
Preserve evidenceExecutive Incident Brief
A concise briefing structure that separates confirmed facts, uncertainty, business impact and decisions required.
View template