Incident Response Psychology — Decision-Making Under Pressure

#Why "No Action" is Worse Than "Bad Action"

The intuition that you should wait until you're certain before acting is wrong in IR. Research from both emergency medicine and military decision science consistently shows that delayed action compounds damage faster than imperfect early action.

The dwell time problem

According to the Mandiant M-Trends report, the median attacker dwell time (time from initial intrusion to detection) has ranged from 24 to 200+ days across different years. Every hour of inaction after detection is an hour of continued attacker access:

The research

Gary Klein's work on Naturalistic Decision Making (NDM) — studying firefighters, ER doctors, and military commanders — found that under time pressure, experienced decision-makers do not evaluate all options. They recognize the situation as a familiar pattern, simulate the first plausible course of action mentally, and act if it seems good enough. The trap is waiting for a plan that has no downside.

The OODA loop (Colonel John Boyd, 1970s): Observe → Orient → Decide → Act. Boyd's key insight, from studying air combat: the side that cycles through the loop faster wins, even if the individual decisions are less optimal. In IR: a faster, imperfect response beats a perfect response that arrives too late.

Practical principleIf you can identify one concrete reversible action (isolate a host, rotate a credential, block a domain), take it while you gather more information. Do not wait for a complete picture to act on the obvious.

#The Mental Model of an IR Responder

Interviewers for IR roles are not testing whether you know every tool. They are assessing how you think. The expected model:

#1. Crown Jewels First

Before asking "what happened?", ask "what am I protecting?"

• Identify what data/systems a successful attack would target: credentials, customer PII, source code, financial records, infrastructure keys
• Work backward from impact: "If the attacker wanted to cause maximum damage, what would they do next?"
• This prevents tunnel vision on a single IoC while missing a larger campaign

#2. Timeline Thinking

All IR is fundamentally a reconstruction problem. Every action leaves a timestamp somewhere. The model:

What is the earliest evidence of attacker activity?
  └→ How did they get in? (initial access vector)
     └→ What did they do immediately after? (discovery, privilege escalation)
        └→ Where did they go from there? (lateral movement)
           └→ What did they touch? (impact assessment)
              └→ What did they leave behind? (persistence)

Never jump to remediation until you've answered all five questions. Eradicating the first foothold while a backdoor persists is worse than leaving both — you've signalled to the attacker that they were detected.

#3. Hypothesis-Driven, Not Tool-Driven

Weak investigators run tools and see what they find. Strong investigators form a hypothesis and look for evidence that confirms or refutes it.

Example hypothesis: "The attacker moved from the web server to the database using a service account credential."

Evidence you need:

• Authentication logs on the database: did the service account log in from an unexpected source IP?
• Web server process list: was there a process spawned with that account's credentials?
• Network logs: is there lateral movement traffic matching the timing?

If you run Volatility and scroll through malfind output without a hypothesis, you will drown in data. If you run it to answer "is there injected shellcode in the memory of the process that owns this suspicious network connection?", you get an answer.

#4. Scope Before Contain

The most common IR mistake made by junior analysts: containment before scoping.

• Blocking the C2 domain before mapping all lateral movement tells the attacker they've been detected — they may destroy evidence or accelerate their mission
• Isolating a single host before confirming the full blast radius may leave other compromised hosts communicating outbound undetected
• Rotating a single credential before auditing all sessions leaves active attacker sessions alive

The correct order

1. Silently observe until you understand the scope
2. Preserve evidence (memory acquisition, log export) before touching systems
3. Contain everything simultaneously when possible — or accept that partial containment tips the attacker off

#Cognitive Biases That Kill IR Investigations

These are the documented failure modes. Knowing them lets you catch yourself.

#Confirmation Bias

You find evidence of ransomware in one place and stop looking. The actual intrusion may have started six months earlier with a credential theft that is now invisible because you stopped looking once you found the "answer."

Counterexplicitly look for evidence that your hypothesis is wrong. Ask: what would I expect to see if this were not ransomware? If I don't see that, is it because it's not there or because I stopped looking?

#Anchoring

The first alert sets the frame for the entire investigation. If the first alert is "malicious PowerShell on workstation," the investigation centers on that workstation. But initial access may have been through a VPN appliance six weeks earlier.

Counteralways build a timeline from the earliest evidence you can find, not the alert timestamp.

#Availability Heuristic

The last incident your team handled was a business email compromise. When ambiguous indicators appear, you pattern-match to BEC. This time it's a supply chain compromise with completely different TTPs.

Counterexplicitly list alternative explanations before committing to a hypothesis. Use the MITRE ATT&CK framework to ask "what else could explain this indicator?"

#Groupthink

In a war room with senior leadership watching, junior analysts defer to the senior analyst's hypothesis. Conflicting evidence gets explained away rather than investigated.

Counterexplicitly ask the most junior person for their interpretation before the senior person speaks. Assign a "devil's advocate" role to someone whose job is to argue against the current hypothesis.

#Tunnel Vision / Sunk Cost

Six hours into investigating a host, you are convinced the intrusion originated there. New evidence points to a different origin, but you've invested too much time to change course.

Countertreat each new finding as if it's the first. "Given only this new evidence, what does it suggest?" Discard the framing of the prior hours and re-evaluate.

#Decision-Making Framework Under Pressure

#The Action Threshold

Not all decisions are equal. Before acting, classify the action:

Irreversible actions require high confidence. Reversible actions should be taken early.

#SBAR — Communication Under Pressure

From emergency medicine. Use this structure every time you brief a stakeholder or request an action:

S — Situation:    "We have a confirmed intrusion on three hosts in the finance VLAN."
B — Background:   "Initial access appears to be a phishing email received yesterday at 09:00.
                   The attacker has been in the environment for ~18 hours."
A — Assessment:   "The attacker has accessed the finance shared drive and is still active.
                   No evidence of exfiltration yet, but the window is closing."
R — Recommendation: "I recommend we isolate the three hosts and rotate the compromised
                     service account credentials within the next 30 minutes."

Brief stakeholders in SBAR order. Never lead with technical details — lead with the current state, then the assessment, then what you need.

#Closed-Loop Communication

From aviation and military: when you give an instruction to another team member, they must read it back, and you must confirm.

"Block outbound connections from 10.0.1.15 to all destinations."
← "Confirming: block all outbound from 10.0.1.15."
"Confirmed."

In a stressful war room, instructions get misheard, misremembered, or not executed. Closed-loop confirms execution without wasted follow-ups.

#What Interviewers Are Assessing

When an interviewer presents an IR scenario, they are evaluating these specifically:

What they are NOT assessingwhether you know every flag of Volatility or every Splunk query syntax. Those can be looked up. Thinking under pressure cannot be outsourced to documentation.

#Key Research and Frameworks