Identifying Gaps in the Response Process
Detecting failures in the process itself
Identifying gaps in the response process means critically evaluating not only what the attacker did, but how the team itself acted, looking for points where the plan failed, was carried out late or where there simply was no procedure defined for the situation encountered. In practice, this requires reviewing each phase of the response, from detection to recovery, comparing actual times against the established objectives and explicitly asking at each stage what would have made it possible to act faster or more effectively. The most revealing gaps are usually at the edges of the formal process, such as the lack of emergency access to a critical system over a weekend or the absence of a clear procedure when two alerts of different severity occur at the same time. Documenting these gaps without filtering, including those that are uncomfortable for the team or leadership, is what distinguishes a post-incident review that generates real improvement from one that just goes through the formality of closing the case.