Skip to main content

Cyber security and incident response

What is the difference between threat intelligence, incident response and digital forensics?

Threat intelligence is what you learn about adversaries before an incident, so detection and defences can be tuned in advance. Incident response is what you do during one: detection, containment, eradication and recovery. Digital forensics is the evidence work that establishes what actually happened, and it must preserve integrity because its output may be used in proceedings.

What is a tabletop exercise?

A tabletop exercise is a discussion-based rehearsal of an incident. The response team walks through a scenario against the plan, without touching production systems, to find the decisions nobody owns and the steps that only work on paper. It is the cheapest way to test an incident response plan before a real incident does it for you.

Guides and toolkits in this area

Browse the full course catalogue

Where to go next

!