Dynamic Incident Response: A Framework for Security Teams

Incident response has long been taught as a linear process, but modern attacks don't follow a script. Dynamic Incident Response introduces the Dynamic Approach to Incident Response (DAIR), a practical, iterative framework that reflects how experienced responders actually work. Written by Joshua Wright, SANS Faculty Fellow and author of SEC504: Hacker Tools, Techniques, and Incident Handling, with contributions from leading experts in ransomware, cloud security, and operational technology, this book bridges the gap between tool-focused guides and high-level strategy. This comprehensive guide covers: The evolution of incident response models and why linear approaches fall short A dynamic, iterative framework emphasizing verification, scoping, and explicit decision-making Step-by-step guidance for each phase: preparation, detection, triage, scoping, containment, eradication, and recovery Specialized chapters on ransomware response, cloud incidents, and industrial control systems Integration with NIST CSF 2.0 Practical applications of AI and automation in incident response Real-world case studies and actionable checklists Whether you're building your organization's incident response capability from scratch or refining existing processes, this book provides the framework and practical techniques needed to respond to incidents more effectively. Endorsed by leaders from Dragos, TrustedSec, GitHub, NASA, Black Hills Information Security, and more.