Security - Event
Security incident
A security problem serious enough to require investigation, containment or recovery
What's it for?
Triggers a proper response when security has been breached or seriously threatened.
For example…
A shared mailbox password appears on a public site. IT opens a security incident so access is revoked, accounts checked, and the path in is understood
An attacker steals employee credentials and accesses customer files, turning the event into a security incident that requires investigation and response
Think of it like…
Fire alarm: you do not argue about whether the toast was only slightly burnt—you follow the drill