The first 24 hours After a cyber incident. A practical playbook
Pen Test Partners
MARCH 23, 2025
Preserve logs, including firewall and VPN activity. Disable accounts you suspect are compromised until you can investigate. Log collection and preservation Secure logs from: Firewalls Authentication systems (Active Directory, etc.) Capture volatile memory (RAM) if you can.
Let's personalize your content