Dynamic Incident Response: A Framework for Security Teams
Dynamic Incident Response: A Framework for Security Teams is a new book by Joshua Wright on incident response. As of September 2026, the online, PDF, and EPUB editions are free to read, download, and share under CC BY 4.0.
What is DAIR?
Most incident response models describe a sequence: prepare, identify, contain, eradicate, recover, learn. Wright’s argument is that real incidents are not linear, and that established models like PICERL and NIST SP 800-61 were built for a simpler era. The book introduces the Dynamic Approach to Incident Response (DAIR) to address the gaps he sees:
- Waypoints, not steps. Detection never stops, and later analysis can send responders back to earlier work.
- Verify and triage. Confirm that an event is really an incident, and prioritize it by what matters to the organization, before committing resources.
- Scoping. Use indicators of compromise and attacker tactics to find the full extent of an incident.
- The response actions loop. Scope, contain, eradicate, and recover repeat as new evidence appears.
- Decision makers in the loop. Response choices reflect business priorities, not only technical ones.
The thinking behind it
DAIR is built on Boyd’s OODA loop (observe, orient, decide, act), the idea that good decisions come from cycling through observation and action as conditions change. The book also includes a crosswalk to NIST CSF 2.0, so teams can map DAIR activities to a widely used framework.
About the author
Joshua Wright is a SANS Faculty Fellow and the author of SANS SEC504: Hacker Tools, Techniques, and Incident Handling. The book includes contributed chapters from Ryan Chapman (ransomware and cyber extortion), Megan Roddie-Fonseca (cloud incident response), and Dean Parsons (operational technology), with a foreword by John Strand.
Publication details
- Title: Dynamic Incident Response: A Framework for Security Teams
- Edition: First edition, September 2026
- Publisher: SANS Institute
- License: Creative Commons Attribution 4.0 (CC BY 4.0)
- Scope: Twenty chapters in three parts: the elements of incident response, the DAIR model, and special considerations (AI-accelerated response, ransomware, cloud, OT, and NIST CSF 2.0)
- Extras: Step-by-step companion checklists for each DAIR waypoint, in PDF and Markdown
- Formats: Read online, by chapter, PDF, and EPUB (Kindle and paperback are listed as coming soon)