What Is Triage in Incident Response?

Definition

Triage is the first decision point in incident response: confirming whether an alert or report is a real security incident, judging how serious it is, and deciding how fast and with whom to respond. Good triage means the dangerous alert gets attention first instead of waiting in line behind the noise.

How It Works

NIST SP 800-61 Revision 3 (April 2025) describes triage as performing "a preliminary review of a new incident report to verify that a cybersecurity incident has occurred, then estimate the severity of the incident and the level of urgency needed to respond to it." In practice, triage answers four questions:

Is it real? Rule out false alarms, test messages, and normal admin activity.
What is affected? Which systems, accounts, and data, and how critical they are.
How bad could it get? NIST lists example risk factors: asset criticality, functional impact, data impact, stage of observed activity, who the attacker appears to be, and recoverability.
Who needs to know? Escalate to the incident lead, leadership, an outside responder, or the insurer.

NIST is blunt about the order of work: "Because of resource limitations, incidents should not be handled on a first-come, first-served basis." The earlier Revision 2 made the same point and urged written guidelines for prioritizing incidents. Triage also starts the record: each incident should be tracked with a summary, related indicators of compromise, assigned actions, and next steps.

Real-World Example

A March 2014 majority staff report for the U.S. Senate Commerce Committee analyzed the 2013 Target breach, in which attackers stole information on as many as 110 million customers. The report found that Target "appears to have failed to respond to multiple automated warnings" from its anti-intrusion software that malware was being installed, and to further warnings about the routes the attackers planned to use to remove data. Citing press reports, the staff wrote that the alerts fired with each malware installation, but the security team neither reacted nor let the software delete the malware. The tools detected the attack. Triage did not act on it.

Why It Matters for a Small Business

Small businesses rarely have a security team watching alerts, so warnings arrive as a strange login email, a customer complaint, or an antivirus pop-up that someone closes. The Target report also notes that the attackers got their first foothold through a third-party vendor, "a small Pennsylvania HVAC company," which shows how small firms sit inside larger attack chains. A missed or slow triage call is often the difference between a contained incident and a reportable breach. A written list of what counts as urgent, and who to call, lets a non-specialist make that first call correctly.

How to Spot It / How DTS Handles It

Signs triage is broken: alerts that go to an inbox nobody reads, everything treated as equally urgent, staff unsure whether to report a suspicious email, and no record of who decided what.

DTS confirms the incident, scores severity against your critical systems and data, preserves evidence before anything is changed, and tells you within the first call whether to escalate to your insurer or counsel. Start with our incident response service or read the first 24 hours after a WordPress hack.

Related Terms

Incident response: the full process triage kicks off.
Indicators of compromise (IOC): the evidence triage weighs.
Containment: the next step once triage confirms an incident.
Incident severity levels: the scale triage assigns.
Security logging: the records that make triage possible.
Incident response retainer: who to escalate to when triage says "call for help."

Sources

NIST, SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management (April 2025): https://csrc.nist.gov/pubs/sp/800/61/r3/final
NIST, SP 800-61 Rev. 2, Computer Security Incident Handling Guide (2012, superseded): https://csrc.nist.gov/pubs/sp/800/61/r2/final
U.S. Senate Committee on Commerce, Science, and Transportation, Majority Staff Report, A "Kill Chain" Analysis of the 2013 Target Data Breach (March 26, 2014): https://www.commerce.senate.gov/services/files/24d3c229-4f2f-405d-b8db-a3a67f183883

Last updated October 14, 2026.