Dynamic Incident Response: Detect. Verify. Respond. Iterate.

The Dynamic Approach to Incident Response (DAIR) is an incident response model developed by Joshua Wright in his book Dynamic Incident Response: A Framework for Security Teams, published by SANS Institute. Unlike PICERL or NIST SP 800-61, which present incident response as a sequence of phases without formalizing when or how to revisit earlier steps, DAIR treats incident response as a set of waypoints rather than sequential steps, built around an iterative Response Actions Loop of Scope, Contain, Eradicate, and Recover. This poster summarizes the model's structure, vocabulary, and the domain-specific guidance for applying it to ransomware, cloud, OT/ICS, and AI-accelerated incidents.

Key Concepts:

• DAIR consists of eight waypoints: Prepare, Detect, Verify & Triage, the Response Actions Loop (Scope, Contain, Eradicate, Recover), and Debrief
• The Response Actions Loop cycles through the Scope, Contain, Eradicate, and Recover waypoints as many times as necessary, rather than once
• DAIR describes waypoints in a journey, not steps in a sequence — detection is an ongoing activity, not a phase that ends
• Verify & Triage is the only waypoint where two actions (verification and prioritization) happen concurrently
• Iteration triggers include new IOCs discovered, scope expansion, incomplete eradication, evidence analysis revelations, and changing business priorities
• A loop exit is a named decision, recording the decision-maker, supporting indicators, residual risks accepted, and the date/time
• NIST SP 800-61r3 replaced its step-by-step technical lifecycle with CSF 2.0 functions, removing the technical guidance defenders relied on, a gap DAIR is built to fill
• Decision-makers — stakeholders, management, and executive leadership — surround every waypoint, not just the response phase
• DAIR maps directly to NIST CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover), generating compliance artifacts at each waypoint
• The model extends to ransomware, cloud, OT/ICS, and AI-accelerated response, applying the same waypoints with domain-specific considerations

DAIR's central departure from prior models is treating iteration as expected progress rather than failure: each pass through Scope, Contain, Eradicate, and Recover is expected to surface new information, and closing the loop requires an explicit, attributable decision rather than an assumed endpoint. This reframing addresses a documented gap in linear models: the absence of verification, scoping, and prioritization as distinct activities, while remaining compatible with existing compliance frameworks like NIST CSF 2.0.

Source

DAIR is presented in Dynamic Incident Response by Joshua Wright, published by SANS Institute. Companion resources are available at sans.org/engage/dynamic-incident-response.