SANS Institute Publishes Dynamic Incident Response by Fellow Joshua Wright, the First Rebuild of the SANS Incident Response Framework in Two Decades

Bethesda, MD, September 15, 2026 — An incident response team is deep into containment when new evidence changes the picture. What looked like a single compromised host is now a dozen systems across three business units. The process most teams follow offers no guidance for that moment: it is a linear path from preparation through recovery, largely unchanged for two decades. It tells teams what to achieve at each stage but not how to adapt, leaving the method to the reader. Today SANS Institute published its successor: Dynamic Incident Response: A Framework for Security Teams by SANS Fellow Joshua Wright that rebuilds the SANS incident response framework around how incidents actually unfold, with findings that change mid-response, priorities that shift, and attackers who adapt while the team works.

The book is free in every digital format under a Creative Commons license because frameworks become standards when they are easily accessible. Formats available include HTML chapters on the companion site, PDF, ePub, and Kindle. Readers who want a bound copy can order one through Kindle print-on-demand at printing cost, with no markup to SANS or to Wright. 

Dr. Eugene Schultz built the original process in 1990, and Stephen Northcutt and Alan Paller made it usable outside government with Computer Security Incident Handling: Step-by-Step, the SANS work this book succeeds. The new framework, the Dynamic Approach to Incident Response (DAIR), aligns to NIST guidance, the Cybersecurity Framework, and current Department of War guidance, and is the version taught in SEC504: Hacker Tools, Techniques, and Incident Handling, the flagship SANS incident handling course Wright authors and leads. 

“For years teaching incident response, I watched responders follow the process of prepare, identify, contain, eradicate, recover, and lessons learned. These models were built for a simpler era, and they don’t hold up against how incidents unfold today,” said Joshua Wright, SANS Fellow and Author of SEC504. “The book introduces DAIR, an adaptive, iterative model built for that reality. It is meant to supplement the excellent industry resources that already exist and give technical analysts the framework they need to respond to incidents more effectively.”

Wright announced the book from the stage at RSAC 2026 in March, after eighteen months of writing. Its twenty chapters span three parts: the elements of incident response, the DAIR model itself, and how the model plays out in the domains that give security teams the most trouble. Three chapters are contributed by SANS instructors writing in their areas of expertise: Megan Roddie-Fonseca on incident response in cloud environments, Dean Parsons on operational technology and control systems, and Ryan Chapman on ransomware and cyber extortion response.

“Joshua Wright has long been one of the most respected minds in cybersecurity, and this book shows exactly why. Dynamic IR challenges the traditional checkbox approach to incident response and replaces it with a practical, adaptive model built for the realities defenders face today,” wrote David Kennedy, Founder and CEO, TrustedSec and Binary Defense, in an endorsement of the book.

Dynamic Incident Response: A Framework for Security Teams is available now. To read the book or order a bound copy, visit sans.org/engage/dynamic-incident-response.

Wright will lead a hands-on workshop on the DAIR model at the SANS AI Cybersecurity Summit in Arlington, Virginia, on November 2 and 3, 2026. To learn more about the Summit, visit http://sans.org/cyber-security-training-events/ai-summit-fall-2026.

About SANS Institute: The SANS Institute is the global leader in cybersecurity training and certifications, trusted by governments, enterprises, and security professionals worldwide. For over three decades, SANS has set the industry standard for technical excellence, equipping practitioners with the real-world skills needed to defend today’s most complex digital environments. As cybersecurity evolves, SANS continues to lead the way, defining best practices and establishing the global benchmark for AI security and emerging technologies.

Media Contact:

Jenn Elston  SANS Institute  301-654-7267  press@sans.org