The first step of cybersecurity incident response usually involves recognising that there is a potential security incident or breach. There are a wide range of tools that can help you with this, including Defender for Microsoft, which can alert you to unusual activity within your Microsoft environment or cloud services. Once you receive an alert, it will need to be thoroughly investigated to determine whether it involves human error, or if your company is under attack. From there, it’s about identifying which systems and networks have been impacted, containing it, and working to eradicate the threat and recover from the attack.