Which component focuses on recognizing incidents early and triggering the response process promptly?

• A. Detection
• B. Analysis
• C. Containment
• D. Communication

Answer: (A)

The main idea here is the moment you become aware of something abnormal and start the response right away. Detection is about monitoring systems, identifying anomalies or signs of compromise, and generating alerts so the incident response process can begin promptly. This early recognition is what kickstarts all subsequent steps—analysis to confirm and understand what happened, containment to limit impact, and communication to coordinate actions and inform stakeholders. The other activities come after a incident is detected: analysis digs into details, containment focuses on stopping spread, and communication ensures everyone involved knows what’s happening and what to do next.