Breach

Breach: Event in which protective mechanisms are bypassed and data or systems are compromised. The term relates to security incident management. Key factors include prepared roles, rapid situational assessment, containmentContainmentActions that limit the scope, spread, and impact of an active security incident., evidence preservationEvidence PreservationThe controlled acquisition and preservation of evidence without compromising its integrity., communication, and structured post-incident reviewPost-Incident ReviewA structured review that captures causes, decisions, outcomes, and lessons after an incident..

How it works and where it fits

Breach belongs to a prepared workflow for handling security-relevant events. A technical signal becomes a substantiated incident only through triage, context, and assessment. Roles, decision authority, escalation paths, and stopping conditions should therefore be agreed in advance so actions remain consistent under time pressure.

Practical security relevance

Execution must balance rapid containment with careful evidence preservation. Actions should not unnecessarily destroy important traces or disrupt business operations without control. Timelines, decisions, and changes are documented; after recovery, root causes, identified gaps, and lessons learned feed back into controls, detection logic, and response plans.

Related concepts

• Incident TriageIncident TriageRapid classification and prioritization of a potential security incident.: Rapid classification and prioritization of a potential security incident.
• Security Operations CenterSecurity Operations CenterA central function for the continuous monitoring, analysis, and response to security events.: A central function for the continuous monitoring, analysis, and response to security events.
• Governance, Risk and ComplianceGovernance, Risk and ComplianceIntegrated approach to managing policies, risks, controls, and evidence.: Integrated approach to managing policies, risks, controls, and evidence.
• Incident ResponseIncident ResponseA structured process for the preparation, detection, containment, eradication, and post-incident review regarding security incidents.: A structured process for the preparation, detection, containment, eradication, and post-incident review regarding security incidents.