How long does incident response take?

Incident response takes anywhere from a few hours to several months, depending on the incident. Containment is measured in hours, investigation usually takes several days, and remediating a deep compromise can stretch over weeks or even months. Preparation and the extent of the attack matter more than company size.

For the full sequence of phases, see our guide How does incident response work?. This article focuses on how long each one takes.

Duration, phase by phase

Phase	Typical order of magnitude	What makes it longer
Mobilising the team	Quick with an agreement already in place	No agreement, searching for a provider mid-crisis
Triage	A few hours	Missing logs, unknown scope
Containment	A few hours	No EDR, flat network
Investigation	Several days	Long-standing compromise, many machines
Eradication and remediation	A few days to several months	Compromised Active Directory, rebuild required
Return to normal and lessons learned	Several weeks	Unusable backups, technical debt

These are indicative. ANSSI’s guide on cyberattacks and remediation stresses that a deep remediation should be run as a project in its own right.

Three typical profiles

An incident contained early. A Microsoft 365 account compromised by phishing, spotted by the SOC before the attacker moves further. Session revoked, password reset, forwarding rules removed, logs checked: most of the work is done the same day. See Managed SOC for Microsoft 365.

An intrusion on a handful of endpoints. The attacker has a foothold on several workstations but has not reached critical servers. Isolation, investigation, clean-up and closer monitoring take a few days.

Ransomware with encryption. Servers encrypted, directory compromised, backups to be verified. The acute crisis lasts several days; rebuilding and remediation take weeks or longer. See When can you restart production after an attack?.

What really drives the duration

1. Time to detect. The longer the attacker went unnoticed, the more history to rebuild and the more machines to check.
2. Preparation. A signed response agreement, current contacts and an escalation procedure save hours from the outset.
3. Visibility. Without an EDR or centralised logs, the investigation works blind and takes longer.
4. Backup health. Offline, tested backups shorten recovery considerably.
5. Speed of decisions. Isolating a business server or cutting remote access: every decision that waits for management prolongs containment.

Deadlines you do not control

While the technical team works, certain clocks are running:

• NIS2 (Article 23): early warning within 24 hours, notification within 72 hours and a final report within one month, for entities in scope. Note that France had not yet adopted its transposition law as of 23 September 2026.
• GDPR (Article 33): notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.
• Insurance in France: the cybermalveillance.gouv.fr ransomware guidance mentions filing a police complaint promptly in connection with a possible cyber insurance claim. The conditions that apply depend on each insurance policy and should be checked with the insurer or a legal adviser.

These deadlines do not mark the end of the response: reporting starts from partial information and is completed later. See Who should you contact after a cyberattack?.

How Cyna is organised

Cyna’s managed SOC is run 24/7 from France by in-house teams, with a human analyst on every alert, which helps detect attacks earlier. Cyna’s CERT, a member of InterCERT France, works with the SOC teams and can be mobilised quickly. The incident response on-call team is available 24/7 from the Report an incident page.

Talk to an expert

Want to estimate how quickly your organisation, or your clients, could respond? If you work with a Cyna partner MSP, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

Can incident response be wrapped up in a day?

Yes, for a limited incident caught early: a compromised mailbox, or a single endpoint isolated before anything spreads. Containment and eradication then take a few hours, followed by closer monitoring.

Why does the investigation take so long?

Because the team has to rebuild what the attacker did, sometimes over weeks of history, and check every machine and account. Incomplete eradication leaves the door open for the attacker to return.

Does the GDPR 72-hour deadline mean the investigation must be finished?

No. Article 33 provides for notification within 72 hours of becoming aware, and allows information to be provided in phases when it is not all available.

How can incident response be made faster?

Through preparation: a response agreement signed in advance, emergency contacts, tested backups, retained logs and an EDR in place. See What is an incident response retainer?.