What is the Incident Response Curve?

The Incident Response Curve (IRC) is a powerful framework that visualises how teams react during the lifecycle of an incident, from recognition through to resolution. Developed by Trevor of Metier Solution, a seasoned professional with over 20 years of experience in defence, cyber and security innovation. The IRC reveals insights about response patterns and identifies opportunities to enhance preparedness and resilience.

The 4 Phases of Incident Response

• Detection: This is the moment when an incident occurs or is first identified. The curve starts to rise as the problem grows. Detection may involve monitoring systems, user reports or automated alerts. The speed and accuracy of detecting an incident directly influence the organisation’s ability to contain and manage it.
• Response: After detection, the response phase begins. This involves classifying the severity of the incident, containing its effects and taking steps to stop its escalation (such as isolating affected systems or shutting down compromised areas). The goal here is to minimise the damage and prevent further spread. In this phase, the curve continues rising, representing the growing impact but effective response can slow the rise.
• Recovery: Once the incident is contained, the focus shifts to recovery—restoring services, recovering data and returning to normal operations. The curve begins to descend as the impact lessens. The speed of recovery depends on factors like the severity of the incident and the readiness of backup systems. Effective recovery strategies bring operations back to normal more quickly and with fewer long-term effects.
• Return to Normal Operations (Norm): The final stage is when normal operations are restored and the incident is resolved. The curve reaches its baseline again. However, after every incident, a post-incident review should take place. This is the time to learn from the incident, identify any weaknesses in detection, response or recovery processes and implement improvements for future preparedness.

Unlock Your Team’s Incident Response Potential

Optimise your event safety and security strategy with our free IRC Calculator.

Using a short, interactive questionnaire, the IRC Calculator will:

• Help you pinpoint where your operation currently sits on the Incident Response Curve
• Reveal key strengths and vulnerabilities in your incident response approach
• Provide tailored, actionable recommendations to boost your capability and help you save time, money and lives
• Support business case development and expenditure justification

At the end of the process, you’ll receive a personalised results summary.

Stay ahead of the curve. Get started now.