If our previous article covered the architecture of the modern SOC, this one is the operating manual. Incident response is where SOC capability is judged — not in the tooling diagrams or the architecture decks, but in the moments when something has actually gone wrong and the clock is running.
The framework below is the NIST SP 800-61r3 incident handling lifecycle, adapted for the realities of 2026 — agentic tooling, regulatory reporting under BNM RMiT and PDPA, and the AI-augmented incident timelines that have meaningfully compressed both detection and response.
The four phases (and where AI augments each)
NIST SP 800-61r3 lifecycle (2026 adaptation)
Phase 1: Preparation
Most incident response failures are preparation failures. Before any incident occurs, the team must have:
- Documented playbooks for the most likely incident classes — credential compromise, ransomware, data exfiltration, cloud account takeover, insider threat. Each playbook specifies decision points, authority levels, communication paths, and containment actions.
- An on-call rotation with documented authority. A 3am incident is not the time to discover that no one has the authority to disable a CEO's account.
- A regular tabletop exercise cadence — quarterly minimum. The best playbooks degrade quickly without practice.
- Pre-built communication templates for the major regulatory and customer notifications. Drafting these under pressure produces poor outcomes.
- Pre-approved containment authorities for specific high-confidence scenarios. The agent layer cannot act without these defined upfront.
AI augmentation: Playbook generation is now substantially faster with AI assistance. LLM-based agents can draft initial playbook content from threat intelligence reports, regulatory documents, and the organisation's existing security architecture. Human review remains essential for accuracy and authority alignment.
Phase 2: Detection & Analysis
The phase where most modern SOCs have invested heavily and where AI augmentation has changed the most. The work covers:
- Initial triage and severity classification.
- Scope determination — how many systems, identities, and data assets are affected.
- Timeline reconstruction — when did the activity begin, when does it end, what was the dwell time.
- TTP attribution — which MITRE ATT&CK techniques were observed; which threat actor profile fits the pattern.
- Containment decision preparation — what actions can be taken safely, what their consequences are, who needs to authorise them.
AI augmentation: The largest single time saving in modern IR. Agents correlate across SIEM, EDR, identity, cloud, and network telemetry simultaneously, reconstruct timelines that previously took hours of manual log review, and present human responders with a coherent narrative ready for decision. Investigation timelines have compressed materially.
Phase 3: Containment, Eradication & Recovery
The pressure phase. Containment must be fast enough to limit damage but considered enough to avoid making the situation worse. Specific patterns:
- Short-term containment: immediate actions to stop active damage — disabling accounts, isolating hosts, blocking IPs. These should be pre-approved for specific patterns and ideally executed automatically by agents.
- Long-term containment: structural changes to prevent the same vector from recurring — credential rotation, configuration hardening, network segmentation. These require more deliberation.
- Eradication: removal of attacker presence — backdoors, scheduled tasks, persistent footholds. The completeness of eradication determines whether the same actor returns.
- Recovery: bringing affected systems back online with confidence they are clean. Often requires rebuild rather than restoration.
AI augmentation: Pre-approved containment actions can be executed by agents within seconds rather than the minutes-to-hours of human-in-the-loop response. The trade-off is the requirement for high-confidence pattern detection and clear pre-approved boundaries.
Phase 4: Post-Incident Activity
The phase most often skipped, and the one where the most learning happens. The work covers:
- Detailed post-incident review — what worked, what did not, where preparation gaps were exposed.
- Detection engineering — every confirmed incident should produce at least one new continuous detection rule mapped to MITRE ATT&CK.
- Playbook updates — playbooks are living documents updated after each significant incident.
- Regulatory reporting — particularly under BNM RMiT for financial institutions, and PDPA for any personal data breach.
- Customer and stakeholder communication — drafted from pre-built templates, customised to specifics.
The Malaysian regulatory layer
For Malaysian financial institutions, the November 2025 RMiT revision tightened incident reporting requirements substantially. Material incidents must be reported to BNM within specific timeframes, and the reporting standards have been raised. The playbook for any RMiT-regulated organisation must include the regulatory reporting workflow as a first-class concern, not an afterthought.
For all Malaysian organisations handling personal data, PDPA breach notification obligations apply. The 2024 PDPA amendments added stricter penalties, materially raising the cost of late or incomplete notifications.
Common incident response failure patterns
Across the incident reviews our team has run with Malaysian organisations in 2025–2026, four failure patterns appear consistently:
- No tested playbook for the actual incident class. Generic playbooks are not enough; specific scenarios need specific playbooks.
- Authority confusion. Multiple people thinking someone else has the authority to act, or no one having the authority to act on a critical decision.
- Communication delays. Internal communication channels not set up, regulatory notification templates not prepared, customer-facing messaging drafted late.
- Skipped post-incident activity. The team moves on to the next priority before the lessons of the current incident are extracted.
What to do this quarter
- Audit your incident response playbook library against the most likely incident classes for your sector. Identify gaps.
- Run a tabletop exercise on the most likely scenario. Document what worked and what did not.
- Pre-draft regulatory reporting templates for BNM RMiT and PDPA.
- Identify which containment actions could be safely automated for high-confidence patterns. Define the pre-approval boundaries.
- Schedule the next tabletop. Cadence beats one-off exercises every time.
For Malaysian SOC and IR teams formalising this capability, our AI Agentic Security programme covers playbook design, tabletop methodology, and the AI augmentation patterns that consistently compress incident timelines. HRDC SBL-KHAS claimable for eligible employers.
