Monday morning, 6:42 a.m.: A suspicious login from an unusual country. Shortly thereafter, several failed authentication attempts on a central server. It is still unclear whether this is a false alarm or the start of an attack. The internal IT team is not fully staffed at this time. Decisions need to be made quickly, and questions arise, such as: - Who assesses the situation in the SOC? - Who is r...