Overview: Triage

Quick Definition

A triage is the process of prioritizing cybersecurity incidents based on their severity, impact, and urgency to determine the order in which they should be addressed. This critical function ensures that security teams allocate their limited resources most effectively during incident response operations.

In cybersecurity contexts, triage typically involves rapidly assessing factors such as the scope of compromise, potential data exposure, business impact, and threat actor sophistication. Incidents are commonly classified using severity levels ranging from low to critical, with high-priority threats like active data exfiltration or ransomware deployment receiving immediate attention while lower-risk issues like failed login attempts may be queued for later investigation.

Effective triage requires both automated tools and human expertise. Security information and event management (SIEM) systems and security orchestration platforms can perform initial automated sorting based on predefined rules, while experienced analysts make final determinations about incident priority. The triage process must balance thoroughness with speed, as delayed response to critical incidents can result in significant damage, while over-responding to minor events wastes valuable resources and may cause alert fatigue among security personnel.