Legal, Compliance & Risk

A breach isn't just an incident — it's a clock that starts ticking.

Security incidents share the discipline of outage response but carry different obligations — notification deadlines, evidence rules, and a regulator who will ask what you knew and when.

Other typical workflows in this domain: contract review & approval, data privacy compliance, and compliance framework management.

Sample workflow: Security incident response

Automation = deterministic, rule-based. AI = judgement at the step level — drafting, scoring, matching. Human = decision, relationship, or anything that sets a precedent.

Illustrative — a representative pattern, not a specific client's workflow.

Stage	Mode	What happens
01Detection	Automation	Endpoint, identity, and log monitoring with tuned alerting.
02Triage	AI	Alerts triaged and classified against a severity ladder.
03Declaration	Human	Incident declared; the response team assembled with clear roles.
04Containment	Automation	Accounts disabled, sessions revoked, hosts isolated — automated where pre-approved.
05Investigation	AI	Scope established — entry point, lateral movement, what was accessed.
06Recovery	Human	Threat removed, systems restored clean, credentials rotated.
07Impact assessment	Human	Personal-data impact assessed — the gate that starts the regulatory clock.
08Notification	Human	Notifications made per obligations — regulator, customers, insurers.
09Customer comms	Human	Affected customers told what happened, honestly.
10Evidence	Automation	Evidence preserved and the timeline logged throughout.
11Post-incident review	Human	Blameless review — how it got in, what slowed response, what changes.
12Hardening	Human	Control improvements implemented and tracked to completion.

01Detection

Automation

Endpoint, identity, and log monitoring with tuned alerting.

02Triage

Alerts triaged and classified against a severity ladder.

03Declaration

Human

Incident declared; the response team assembled with clear roles.

04Containment

Automation

Accounts disabled, sessions revoked, hosts isolated — automated where pre-approved.

05Investigation

Scope established — entry point, lateral movement, what was accessed.

06Recovery

Human

Threat removed, systems restored clean, credentials rotated.

07Impact assessment

Human

Personal-data impact assessed — the gate that starts the regulatory clock.

08Notification

Human

Notifications made per obligations — regulator, customers, insurers.

09Customer comms

Human

Affected customers told what happened, honestly.

10Evidence

Automation

Evidence preserved and the timeline logged throughout.

11Post-incident review

Human

Blameless review — how it got in, what slowed response, what changes.

12Hardening

Human

Control improvements implemented and tracked to completion.

Find out how your business could run.

Book a discovery call